Is CVE-2026-13321 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13321 being exploited in the wild.

How severe is CVE-2026-13321?

High severity, with a CVSS score of 8.6, published 22 July 2026.

Which products and versions are affected?

Isc BIND 9 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.24-S1.

Is there a fix for CVE-2026-13321?

A patch was published on 2026-07-22: Patched versions 9.20.26 and 9.21.24 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13321 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-13321?

Check whether you run Isc BIND 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13321: ISC BIND DNSSEC validation bypass in NSEC records

CVE-2026-13321 · Severity: high · CVSS 8.6 · Published 2026-07-22

BIND 9, a widely used system for translating human-readable domain names into IP addresses, contains a vulnerability in how it validates security records. An attacker can exploit this to trick the system into believing certain websites or services do not exist, even when they are legitimate. This can lead to a denial of service for specific web resources or redirected traffic, potentially disrupting business operations and user access to services.

Technologies: Isc BIND 9. Vendors: Isc.

Quick answers

Is CVE-2026-13321 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13321 being exploited in the wild.
How severe is CVE-2026-13321?: High severity, with a CVSS score of 8.6, published 22 July 2026.
Which products and versions are affected?: Isc BIND 9 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.24-S1.
Is there a fix for CVE-2026-13321?: A patch was published on 2026-07-22: Patched versions 9.20.26 and 9.21.24 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13321 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-13321?: Check whether you run Isc BIND 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the BIND 9 resolver's DNSSEC validation logic (CWE-346). The resolver accepts validly-signed NSEC records where the 'Next Domain Name' field points to a location outside the signer's authoritative zone. A remote, unauthenticated attacker controlling a DNSSEC-signed zone can craft malicious NSEC records that span into victim zones. This allows the attacker to perform cross-zone cache poisoning, providing authenticated denial-of-service responses (with the AD bit set) for records they do not own. The issue is resolved in BIND versions 9.20.26, 9.21.24, and 9.20.26-S1.

Affected products

ISC BIND 9 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, 9.20.9-S1 through 9.20.24-S1

Timeline

2026-07-15: other: Early Notification
2026-07-22: disclosed: Public disclosure
2026-07-22: patched: Patched versions 9.20.26 and 9.21.24 released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.