VulnSocial

CVE-2026-13321Patch

MEDIUMCVSS 8.6 · HIGH

Exploitation observed; activity peaked at 7 mentions and remains active

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Back to dashboard
4.3/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-346

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 21 mentions across 9 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 13 signals
  • Technical details provided in 9 signals
  • Disclosure: 4 classified signals
  • General: 3 classified signals
  • Peaked 7d ago at 7 mentions (2026-07-23); latest day: 1
  • 21 total mentions across 9 days

Deep dive

Activity timeline21 mentions / 9d
02457Mentions · 2026-07-22: 3Mentions · 2026-07-23: 7Mentions · 2026-07-27: 1Mentions · 2026-08-03: 1Mentions · 2026-08-11: 1Mentions · 2026-08-14: 3Mentions · 2026-08-17: 3Mentions · 2026-08-18: 1Mentions · 2026-08-19: 1Active Exploitation · 2026-07-23: 1Patch / Workaround · 2026-07-22: 1Patch / Workaround · 2026-07-23: 3Patch / Workaround · 2026-08-11: 1Patch / Workaround · 2026-08-14: 3Patch / Workaround · 2026-08-17: 3Patch / Workaround · 2026-08-18: 1Patch / Workaround · 2026-08-19: 1Technical Details · 2026-07-22: 2Technical Details · 2026-07-23: 2Technical Details · 2026-07-27: 1Technical Details · 2026-08-11: 1Technical Details · 2026-08-17: 1Technical Details · 2026-08-18: 1Technical Details · 2026-08-19: 107-2207-2307-2708-0308-1108-1408-1708-1808-19
Signal classification4 categories
Patch
1361.9%
Disclosure
419.0%
General
314.3%
Active Exploitation
14.8%
Referenced assets25 URLs
By indicator
Classification over time
DateTotalLabels
2026-07-223
Disclosure2Patch1
2026-07-237
Active Exploitation1Disclosure1General2Patch3
2026-07-271
Disclosure1
2026-08-031
General1
2026-08-111
Patch1
2026-08-143
Patch3
2026-08-173
Patch3
2026-08-181
Patch1
2026-08-191
Patch1
Full discourse20 posts
  • Wazuh@wazuh
    Patch

    BIND is affected by CVE-2026-13321 (CVSS 8.6 - High), a DNSSEC validation flaw that can let crafted NSEC records bypass intended resolver checks. Upgrade to BIND 9.20.26, 9.21.24, or 9.20.26-S1. Read more: https://ow.ly/mKX550Zyya0 https://t.co/W4g2gx4vrb

    Post summary

    BIND suffers from a high‑severity DNSSEC validation flaw (CVE-2026-13321) that can be mitigated by upgrading to the specified BIND versions.

    07090668
    8.3K followersView on X
  • 日本レジストリサービス（JPRS）@JPRS_official
    Patch

    【注意喚起】（緊急）BIND 9.xの脆弱性（名前解決の妨害）について（CVE-2026-13321） - バージョンアップを強く推奨 - https://jprs.jp/tech/security/2026-07-23-bind9-vuln-nsec.html

    Post summary

    An advisory warns about a name‑resolution disruption vulnerability in BIND 9.x (CVE‑2026‑13321) and urges users to upgrade immediately.

    05180941
    1.3K followersView on X
  • Yasuhiro Morishita@OrangeMorishita
    Patch

    【自分用メモ】BIND 9の脆弱性(High: CVE-2026-11331, CVE-2026-11605, CVE-2026-11622, CVE-2026-11721, CVE-2026-12617, CVE-2026-13204, CVE-2026-13321, Medium: CVE-2026-10723, CVE-2026-10822)と修正バージョン(9.20.26, 9.21.24) https://security.sios.jp/vulnerability/bind9-security-vulnerability-20260723/

    Post summary

    The memo provides a catalog of High and Medium‑severity BIND 9 CVEs and references the corresponding patch releases (9.20.26, 9.21.24) via a vulnerability advisory link.

    12080922
    4.6K followersView on X
  • Daily CyberSecurity@Daily_CyberSec
    Patch

    ISC fixed 9 BIND vulnerabilities in 9.20.26 and 9.21.24. The top BIND vulnerability, CVE-2026-13321, enables DNSSEC cache poisoning. Patch now. #BIND9 #DNSSEC #CachePoisoning #CVE202613321 #DNSSecurity #InfoSec http://securityonline.info/bind-vulnerability-9-cves-dnssec/

    Post summary

    ISC has released patches for nine BIND CVEs, including CVE-2026-13321 that allows DNSSEC cache poisoning, and urges users to upgrade to versions 9.20.26 or 9.21.24.

    03071467
    12.9K followersView on X
  • Yu F@fj_twt
    Patch

    ( ꒪⌓꒪)…灼熱の特大号 New BIND 9 releases: 9.20.26, 9.21.24 https://lists.isc.org/pipermail/bind-announce/2026-July/001299.html https://kb.isc.org/docs/cve-2026-10723 https://kb.isc.org/docs/cve-2026-10822 https://kb.isc.org/docs/cve-2026-11331 https://kb.isc.org/docs/cve-2026-11605 https://kb.isc.org/docs/cve-2026-11622 https://kb.isc.org/docs/cve-2026-11721 https://kb.isc.org/docs/cve-2026-12617 https://kb.isc.org/docs/cve-2026-13204 https://kb.isc.org/docs/cve-2026-13321

    Post summary

    The post communicates the release of BIND 9 updates (9.20.26 & 9.21.24) that address multiple CVEs, with links to the vendor’s knowledge base for each fix.

    01180835
    1.6K followersView on X
  • Kazuki Omo@omokazuki
    Disclosure

    BIND 9の脆弱性(High: CVE-2026-11331, CVE-2026-11605, CVE-2026-11622, CVE-2026-11721, CVE-2026-12617, CVE-2026-13204, CVE-2026-13321, Medium: CVE-2026-10723, CVE-2026-10822) #sios_tech #security #vulnerability #セキュリティ #脆弱性 #dns #bind https://security.sios.jp/vulnerability/bind9-security-vulnerability-20260723/

    Post summary

    The post announces several high and medium severity BIND 9 vulnerabilities by listing CVE identifiers and linking to a website for more details, but it does not provide PoC, exploit, patch, or active exploitation information.

    02040332
    372 followersView on X
  • まこぴ@makopicut
    Patch

    RHSA-2026:54509 - bind9.16 security update (RHEL8) Security Fix(es): - CVE-2026-11331 - CVE-2026-13321 - CVE-2026-11622 - CVE-2026-11721 - CVE-2026-13204 - CVE-2026-10723 https://access.redhat.com/errata/RHSA-2026:54509

    Post summary

    Red Hat released a security update for bind9.16 addressing several CVEs, providing a patch via the RHSA errata.

    11011123
    117 followersView on X
  • 日本レジストリサービス（JPRS）@JPRS_official
    Disclosure

    【メールマガジン（FROM JPRS）】最新号を掲載しました。 通常号 vol.1255「（緊急）BIND 9.xの脆弱性（名前解決の妨害）について（CVE-2026-13321）、他9件」など https://jprs.jp/mail/backnumber/2026/260727.html

    Post summary

    The newsletter announces the newly disclosed CVE-2026-13321 affecting BIND 9.x, specifying it causes name resolution denial.

    00030308
    1.3K followersView on X
  • doseisan_ons@doseisan_ons
    General

    CVE-2026-13321、またDNSSECか。デメリットしかないしやめればいいのに

    Post summary

    The text merely references CVE‑2026‑13321 in passing and expresses a negative opinion about DNSSEC, but provides no technical details, PoC, exploit, or patch information.

    02010639
    137 followersView on X
  • VulDB 🛡@vuldb
    Disclosure

    The severity is increased for this new vulnerability affecting ISC BIND (CVE-2026-13321) https://vuldb.com/vuln/382364

    Post summary

    The post announces that severity has increased for a new ISC BIND vulnerability (CVE-2026-13321) and provides a link for more information.

    01020261
    2.3K followersView on X
  • まこぴ@makopicut
    Patch

    RHSA-2026:54654 - bind security update (RHEL8) - CVE-2026-13321 - CVE-2026-11622 - CVE-2026-11721 - CVE-2026-13204 - CVE-2026-10723 https://access.redhat.com/errata/RHSA-2026:54654

    Post summary

    Red Hat has released a bind security update for RHEL 8 that addresses several CVEs, providing fixes via the linked errata.

    1001058
    117 followersView on X
  • まこぴ@makopicut
    Patch

    RHSA-2026:54510 - bind security update (RHEL9) Security Fix(es): - CVE-2026-11331 - CVE-2026-13321 - CVE-2026-11622 - CVE-2026-11721 - CVE-2026-13204 - CVE-2026-10723 https://access.redhat.com/errata/RHSA-2026:54510

    Post summary

    Red Hat released an RHEL9 security update addressing six CVEs, providing patches but offering no details about exploitation or PoC.

    1001061
    117 followersView on X
  • Yasuhiro Morishita@OrangeMorishita
    General

    【自分用メモ】CVE-2026-13321 ISC BIND Resolver input validation https://vuldb.com/vuln/382364

    Post summary

    The note simply references CVE‑2026‑13321 for ISC BIND Resolver input validation and links to a vulnerability database page, offering no further technical details, exploit information, or remediation guidance.

    00020541
    4.6K followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-13321 The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 t… https://www.cve.org/CVERecord?id=CVE-2026-13321

    Post summary

    The post announces a vulnerability in BIND 9 where the resolver accepts NSEC records with Next Domain Name fields outside the signer's zone, providing brief technical detail but no PoC, exploit, patch, or active exploitation claim.

    00011765
    57.8K followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    Patch

    ISC BIND 9にDNSSEC検証回避脆弱性、CVSS 8.6で更新必須 https://www.cybernote.click/2026/08/11/isc-bind-cve-2026-13321-dnssec-validation-bypass/ #IT #Security #cybersecurity

    Post summary

    The text highlights a high‑severity DNSSEC validation bypass in ISC BIND 9 (CVSS 8.6) and stresses the need for an urgent update.

    0001065
    209 followersView on X
  • まこぴ@makopicut
    Patch

    RHSA-2026:55437 - bind security update (RHEL10) Security Fix(es): - CVE-2026-11331 - CVE-2026-13321 - CVE-2026-11622 - CVE-2026-11721 - CVE-2026-13204 - CVE-2026-10723 https://access.redhat.com/errata/RHSA-2026:55437

    Post summary

    Red Hat Security Advisory RHSA-2026:55437 provides a security update for RHEL10, patching six bind CVEs, with no evidence of PoCs, exploitation, or active attacks.

    1000043
    117 followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    Patch

    ISC BIND 9にDNSSEC検証回避脆弱性、CVSS 8.6で更新必須 https://www.cybernote.click/2026/08/11/isc-bind-cve-2026-13321-dnssec-validation-bypass/ #IT #Security #cybersecurity

    Post summary

    ISC BIND 9 has a DNSSEC validation bypass vulnerability with a CVSS score of 8.6; an update is required to mitigate the risk.

    0000027
    210 followersView on X
  • まこぴ@makopicut
    Patch

    RHSA-2026:55442 - bind9.18 security update (RHEL9) Security Fix(es): - CVE-2026-11331 - CVE-2026-13321 - CVE-2026-11622 - CVE-2026-11721 - CVE-2026-13204 - CVE-2026-10723 https://access.redhat.com/errata/RHSA-2026:55442

    Post summary

    Red Hat releases RHSA-2026:55442 for bind9.18, outlining several affected CVEs and indicating that security fixes are provided.

    0000037
    117 followersView on X
  • ケイ | IT・セキュリティ系副業Webライター@Teeeda_worker
    Patch

    ISC BIND 9にDNSSEC検証回避脆弱性、CVSS 8.6で更新必須 https://www.cybernote.click/2026/08/11/isc-bind-cve-2026-13321-dnssec-validation-bypass/ #IT #Security #cybersecurity

    Post summary

    The post alerts users to a DNSSEC validation bypass vulnerability (CVE‑2026‑13321) in ISC BIND 9 with a CVSS score of 8.6, urging an update to address the flaw.

    0000028
    210 followersView on X
  • CERT-PY@CERTpy
    General

    ⚠️ Vulnerabilidades en productos ISC ❗ CVE-2026-13321 ❗ CVE-2026-13204 ❗ CVE-2026-12617 ➡️ Más info: https://www.cert.gov.py/vulnerabilidades-en-productos-isc-2/ https://t.co/F9ZBhRX5OR

    Post summary

    The tweet lists three new ISC product CVEs and directs readers to a CERT page for further information.

    00000205
    6.7K followersView on X

Explore more

Back to dashboard