Is CVE-2026-78301 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78301 being exploited in the wild.

How severe is CVE-2026-78301?

Medium severity, with a CVSS score of 5.8, published 16 September 2026.

Which products and versions are affected?

Isc Bind 9.11.0–9.18.50, 9.20.0–9.20.27, 9.21.0–9.21.25, 9.11.3-S1–9.18.50-S1, 9.20.9-S1–9.20.27-S1.

Is there a fix for CVE-2026-78301?

A patch was published on 2026-09-16: Patches released in BIND 9.20.29 and 9.21.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78301 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-78301?

Check whether you run Isc Bind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78301: ISC BIND named zone parsing vulnerability

CVE-2026-78301 · Severity: medium · CVSS 5.8 · Published 2026-09-16

BIND is the most widely deployed DNS server software used by internet service providers and enterprises to host DNS zones. A malformed zone file containing improperly placed NS or DNAME records can cause the DNS server to mishandle queries and, on recursive resolvers, cache incorrect DNS data. This allows an attacker who can upload a malformed zone to inject false DNS records that affect external domains, potentially enabling phishing, malware distribution, or service disruption.

Technologies: Isc Bind. Vendors: Isc.

Quick answers

Is CVE-2026-78301 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78301 being exploited in the wild.
How severe is CVE-2026-78301?: Medium severity, with a CVSS score of 5.8, published 16 September 2026.
Which products and versions are affected?: Isc Bind 9.11.0–9.18.50, 9.20.0–9.20.27, 9.21.0–9.21.25, 9.11.3-S1–9.18.50-S1, 9.20.9-S1–9.20.27-S1.
Is there a fix for CVE-2026-78301?: A patch was published on 2026-09-16: Patches released in BIND 9.20.29 and 9.21.26 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78301 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-78301?: Check whether you run Isc Bind at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a zone parsing flaw in BIND's named server where a malformed zone containing an NS or DNAME node above its origin is incorrectly treated as a zone cut. An attacker can exploit this by inserting a malformed zone via zone transfer (AXFR) or similar mechanisms. On authoritative-only servers, queries lose their authoritative status and return out-of-zone delegations; on servers that also provide recursive resolution, BIND follows these locally-sourced cuts, caches attacker-supplied data, and can poison the cache with false records for domains outside the configured zone. The issue persists until the malformed zone is removed from the database. Patches are available in BIND 9.20.29, 9.21.26, and corresponding BIND 9 ESV releases.

Affected products

ISC BIND 9.11.0–9.18.50, 9.20.0–9.20.27, 9.21.0–9.21.25, 9.11.3-S1–9.18.50-S1, 9.20.9-S1–9.20.27-S1

Timeline

2026-09-16: disclosed: CVE-2026-78301 published
2026-09-16: patched: Patches released in BIND 9.20.29 and 9.21.26

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.