ISC BIND 9 CVE-2026-13321

Exploitation requires the attacker to control a DNSSEC-signed authoritative zone (or be able to inject validly-signed NSEC records) and to get a target BIND 9 resolver to query that zone and perform DNSSEC validation on the response - the specific prerequisite is that the malicious NSEC record is correctly signed for the attacker's zone but carries a 'Next Domain Name' pointing outside that signer's zone. The core weakness needs no authentication against the resolver (PR:N) and no user interaction (UI:N), consistent with an unauthenticated network attacker. Limiting factors: the resolver must have DNSSEC validation enabled (resolvers not validating DNSSEC are unaffected by the forged-proof aspect), the victim must be running an affected BIND 9 version in a resolver role, and the attacker must possess a legitimately signed zone whose responses reach the target, which constrains this toward malicious-or-compromised zone operators rather than any anonymous internet host.

Signals are largely consistent and point to a genuine, high-priority integrity issue rather than an inflated CVSS. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N, base 8.6) indicates a network-reachable, low-complexity, unauthenticated attack with a scope change and high integrity impact - appropriate for a cross-zone DNSSEC bypass where a malicious authoritative operator can affect resolution of names in zones they do not own. There is no EPSS score, no POC, and no KEV listing provided, so exploitation is currently theoretical/latent: this is a design/validation flaw affecting the security guarantee of DNSSEC rather than a memory-corruption RCE, and weaponization requires the attacker to control a signed zone that victim resolvers will query. One conflict to flag: the vendor Tags label this 'Information Disclosure', but the CVSS vector sets C:N and I:H - the impact is more accurately an integrity/authentication bypass (forged proof of non-existence) than confidentiality loss, so the 'Information Disclosure' tag should be treated with skepticism. Priority is high for internet-facing recursive resolvers relying on DNSSEC validation.

An attacker who operates or compromises a DNSSEC-signed authoritative zone crafts a validly-signed NSEC record whose 'Next Domain Name' points at a name in a victim zone outside their authority, then induces a target BIND resolver to query their zone. The resolver validates the signature, accepts the out-of-bailiwick NSEC as a legitimate proof of non-existence, and can be made to treat names in the victim zone as nonexistent. No public POC is currently identified, and the network vector with low complexity (AV:N/AC:L) means no special timing or user interaction is required once the resolver queries the malicious zone.