ISC BIND NSEC3 Record Validation Vulnerability (CVE-2026-10723) Advisory

Vulnerability Overview CVE ID: CVE-2026-10723 Title: Incorrect acceptance of NSEC3 records Description: BIND may incorrectly accept subdomain NSEC3 records as valid, potentially allowing an attacker to forge authenticated NXDOMAIN responses. Severity: Medium Exploitability: Remotely CVSS Score: 6.8 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Scope Affected Versions: - BIND: - 9.18.0 -> 9.18.50 - 9.20.0 -> 9.20.24 - 9.21.0 -> 9.21.23 - BIND Supported Preview Edition: - 9.11.3-S1 -> 9.18.50-S1 - 9.20.9-S1 -> 9.20.24-S1 Remediation Solution: Upgrade to the closest patched version for the current BIND release: - 9.20.26 - 9.21.24 BIND Supported Preview Edition: 9.20.26-S1 Additional Information Workarounds: None known. Active Exploitation: No known active exploitation exists. Credits: ISC thanks Qifan Zhang of Palo Alto Networks for reporting this vulnerability. Document Revision History: - 1.0 Early notice, July 15, 2026 - 1.1 Revised fixed version list, July 20, 2026 - 2.0 Public announcement, July 22, 2026 Related Links ISC Security Vulnerability Disclosure Policy ISC Software Defect and Security Vulnerability Disclosure Policy Legal Disclaimer ISC provides this notification on an "AS IS" basis, without any express or implied warranties. ISC expressly disclaims and denies all warranties regarding this notification or any materials, information, or content mentioned herein, including but not limited to warranties of merchantability, fitness for a particular purpose, and non-infringement. Notes ISC only patches currently supported versions. When possible, we indicate affected End-of-Life (EOL) versions. Information on currently supported versions can be found at the ISC Download Page. Contact Questions regarding this advisory should be posted as confidential GitLab issues: GitLab Issue Link Additional Documentation See the BIND 9 Security Vulnerability Matrix for a complete list of security vulnerabilities and affected versions. FAQ If you have further questions, please contact us via the GitLab issue link above. Disclaimer Internet Systems Consortium (ISC) provides this notification on an "AS IS" basis, without any express or implied warranties. ISC expressly disclaims and denies all warranties regarding this notification or any materials, information, or content mentioned herein, including but not limited to warranties of merchantability, fitness for a particular purpose, and non-infringement. Legal Terms Nothing in this notification shall be construed as a warranty or guarantee by ISC for any particular purpose. ISC is not liable for anything contained in this notification, including but not limited to any errors or omissions. ISC reserves the right to modify this notification at any time without notice. Contact Questions regarding this advisory should be posted as confidential GitLab issues: GitLab Issue Link Additional Documentation See the BIND 9 Security Vulnerability Matrix for a complete list of security vulnerabilities and affected versions. FAQ If you have further questions, please contact us via the GitLab issue link above. Disclaimer ISC provides this notification on an "AS IS" basis, without any express or implied warranties. ISC expressly disclaims and denies all warranties regarding this notification or any materials, information, or content mentioned herein, including but not limited to warranties of merchantability, fitness for a particular purpose, and non-infringement. Legal Terms Nothing in this notification shall be construed as a warranty or guarantee by ISC for any particular purpose. ISC is not liable for anything contained in this notification, including but not limited to any errors or omissions. ISC reserves the right to modify this notification at any time without notice.

Goal Reached Thanks to every supporter — we hit 100%!

ISC BIND NSEC3 Record Validation Vulnerability (CVE-2026-10723) Advisory