Is CVE-2026-76163 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76163 being exploited in the wild.

How severe is CVE-2026-76163?

High severity, with a CVSS score of 7.5, published 16 September 2026.

Which products and versions are affected?

Isc Bind 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.20.9-S1 through 9.20.27-S1.

Is there a fix for CVE-2026-76163?

A patch was published on 2026-09-16: Patches released in versions 9.20.29 and 9.21.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76163 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-76163?

Check whether you run Isc Bind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76163: ISC BIND assertion failure in TKEY query handling

CVE-2026-76163 · Severity: high · CVSS 7.5 · Published 2026-09-16

BIND is a widely used DNS resolver and authoritative name server software that forms a critical part of internet infrastructure. When BIND's configuration file is missing a global options block, attackers can send a specially crafted DNS query (TKEY type) that triggers an assertion failure, causing the DNS service to crash and resulting in denial of service for all users relying on that nameserver.

Technologies: Isc Bind. Vendors: Isc.

Quick answers

Is CVE-2026-76163 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76163 being exploited in the wild.
How severe is CVE-2026-76163?: High severity, with a CVSS score of 7.5, published 16 September 2026.
Which products and versions are affected?: Isc Bind 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.20.9-S1 through 9.20.27-S1.
Is there a fix for CVE-2026-76163?: A patch was published on 2026-09-16: Patches released in versions 9.20.29 and 9.21.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76163 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-76163?: Check whether you run Isc Bind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a denial-of-service condition caused by an assertion failure in BIND's TKEY query processing. The root cause is improper handling of TKEY queries when the named.conf configuration lacks a global options block, resulting in an uninitialized or null state that the TKEY handler does not validate before use. An unauthenticated attacker on the network can send a single malicious TKEY query to the nameserver to trigger the assertion and crash the process. The vulnerability affects BIND 9 versions 9.20.0–9.20.27, 9.21.0–9.21.25, and 9.20.9-S1–9.20.27-S1. Patches are available in versions 9.20.29 and 9.21.26 as evidenced by the release dates matching the advisory publication.

Affected products

ISC BIND 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.20.9-S1 through 9.20.27-S1

Timeline

2026-09-16: disclosed
2026-09-16: patched: Patches released in versions 9.20.29 and 9.21.26

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.