The Internet Systems Consortium has issued fixes for 14 vulnerabilities in BIND, the DNS server software that answers name lookups for a large slice of the internet's infrastructure. A bulletin published by HKCERT on 18 September summarises the batch: a remote attacker could use some of the flaws to trigger a denial of service, manipulate data, or get around security restrictions on an affected server.
Nothing in the advisory suggests any of them are being exploited.
Why a DNS bug costs more than it looks
BIND is the reference implementation of the domain name system, and the resolvers running it sit in front of everything else on a network: mail, web, VPN, internal service discovery. A resolver that stops answering does not break one application, it breaks every application at once, which is what makes a denial of service finding heavier here than in most software.
The identifiers in this batch are CVE-2026-19033, CVE-2026-19662, CVE-2026-19666, CVE-2026-19667, CVE-2026-19668, CVE-2026-19941, CVE-2026-75029, CVE-2026-76163, CVE-2026-77119, CVE-2026-77692, CVE-2026-78301, CVE-2026-80274, CVE-2026-81563 and CVE-2026-81736. HKCERT rates the set as medium risk overall and publishes no severity score for any individual flaw, and the bulletin does not describe how any of them work. Anyone who needs that detail should read the vendor's own advisories rather than infer it from the identifier list.
Which builds are on the list
The bulletin names BIND 9.11.0 through 9.18.50, 9.18.0 through 9.18.50, 9.20.0 through 9.20.27 and 9.21.0 through 9.21.25, plus the Supported Preview Edition from 9.11.3-S1 through 9.18.50-S1 and from 9.20.9-S1 through 9.20.27-S1.
Update to 9.20.29 or 9.21.26
The fixed releases listed are BIND 9.20.29, BIND 9.21.26 and Supported Preview Edition 9.20.29-S1. The bulletin offers no fixed build in the 9.18 line even though 9.18 versions appear as affected, so operators still on that branch should check ISC's advisory for their version before assuming a patch exists for it. ISC publishes a page per CVE in its knowledge base, for example the entry for CVE-2026-81736, and those pages, not the summary bulletin, are the authoritative word on impact and workarounds.
Distribution packages normally trail upstream by days, so sites running BIND from an operating system vendor should watch for the backport rather than wait on ISC's own tarball. Where patching has to be scheduled, ordinary DNS hygiene buys time: restrict recursion to known clients, keep authoritative and recursive roles on separate instances, and alert on a resolver that goes quiet. Name resolution has been a recurring pressure point this year, including an F5 BIG-IP DNS flaw that shipped with workarounds and no patch at all.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.