ISC has released BIND 9.20.30 and 9.21.27, addressing four high-rated vulnerabilities, including one that could lead to remote code execution (RCE). The critical flaw, CVE-2026-94300, involves GSS-TSIG memory corruption and has a CVSS score of 8.1, though its exploitation is considered complex. The other three vulnerabilities are denial-of-service issues, each rated 7.5, and require specific configurations to exploit. ISC urges users still on the older 9.18 version to upgrade to 9.20, as it has reached end-of-life and will not receive further security updates

ISC Releases BIND 9.20.30 and 9.21.27, Patching Four Flaws Including an RCE

ISC has released BIND 9.20.30 (stable) and 9.21.27 (development) as its fourth monthly BIND security update of 2026, all four vulnerabilities rated High. One flaw, CVE-2026-94300, carries a CVSS 8.1 score and a working path to remote code execution via GSS-TSIG memory corruption, though exploitation complexity is High. The remaining three flaws are denial-of-service variants rated 7.5, each requiring specific or unusual resolver configurations. ISC says it isn't aware of active exploitation and urges operators on branch 9.18 to migrate to 9.20.

ISC Releases BIND 9.20.30 and 9.21.27, Patching Four Flaws Including an RCE @ Linux Compatible