VulnSocial

CVE-2026-77692Disclosure

MEDIUMCVSS 7.5 · HIGH

Exploitation ongoing with high activity in latest observed window (3 mentions)

Immediate actions

  • Patch affected systems immediately
  • Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

An attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely. This issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.

Back to dashboard
4.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-476

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • Patch or workaround signal is available
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • General: 1 classified signal
  • Peaked at 3 mentions on most recent observed day (2026-09-17)
  • 4 total mentions across 2 days

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-09-16: 1Mentions · 2026-09-17: 3Active Exploitation · 2026-09-17: 1Patch / Workaround · 2026-09-17: 2Technical Details · 2026-09-17: 209-1609-17
Signal classification4 categories
Disclosure
125.0%
Active Exploitation
125.0%
General
125.0%
Patch
125.0%
Referenced assets16 URLs
Classification over time
DateTotalLabels
2026-09-161
Disclosure1
2026-09-173
Active Exploitation1General1Patch1
Full discourse4 posts
  • Yasuhiro Morishita@OrangeMorishita
    General

    【自分用メモ】今月は14件。High7件。 https://kb.isc.org/docs/cve-2026-19033 https://kb.isc.org/docs/cve-2026-19662 https://kb.isc.org/docs/cve-2026-19666 https://kb.isc.org/docs/cve-2026-19667 https://kb.isc.org/docs/cve-2026-19668 https://kb.isc.org/docs/cve-2026-19941 https://kb.isc.org/docs/cve-2026-75029 https://kb.isc.org/docs/cve-2026-76163 https://kb.isc.org/docs/cve-2026-77119 https://kb.isc.org/docs/cve-2026-77692 https://kb.isc.org/docs/cve-2026-78301 https://kb.isc.org/docs/cve-2026-80274 https://kb.isc.org/docs/cve-2026-81563 https://kb.isc.org/docs/cve-2026-81736

    Post summary

    The note lists 14 CVE-2026 entries from ISC KB, highlighting that 7 are rated High severity, without further details.

    032821.6K
    4.6K followersView on X
  • 日本レジストリサービス（JPRS）@JPRS_official
    Patch

    （緊急）BIND 9.xの脆弱性（DNSサービスの停止）について（CVE-2026-77692） - バージョンアップを強く推奨 - https://jprs.jp/tech/security/2026-09-17-bind9-vuln-doh.html

    Post summary

    The alert announces an emergency BIND 9.x vulnerability (CVE-2026-77692) that can stop DNS service and urges users to upgrade to a patched version.

    02030426
    1.3K followersView on X
  • Yu F@fj_twt
    Disclosure

    🤮 cve-2026-19033 cve-2026-19662 cve-2026-19666 cve-2026-19667 cve-2026-19668 cve-2026-19941 cve-2026-75029 cve-2026-76163 cve-2026-77119 cve-2026-77692 cve-2026-78301 cve-2026-80274 cve-2026-81563 cve-2026-81736

    Post summary

    The message is simply a list of CVE identifiers with no PoC, exploit, patch, or active‑exploitation evidence, representing a disclosure of multiple vulnerabilities.

    00010224
    1.6K followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    Attackers exploited BIND 9 DNS-over-HTTPS servers using single malformed SIG(0) requests to cause immediate crashes (CVE-2026-77692). TRC analysis shows how DNS infrastructure compromise enables lateral movement through recursive resolvers and cache poisoning across network segments. #DNSSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/bind-9-update-fixes-14-flaws-including-unauthenticated-crash-dns-over-https-2026

    Post summary

    The text reports active in-the-wild exploitation of CVE-2026-77692 against BIND 9 DNS-over-HTTPS servers via malformed SIG(0) requests, leading to crashes and potential lateral movement, and references a vendor update that addresses the flaw among others.

    0000066
    2.0K followersView on X

Explore more

Back to dashboard