# CERT-FR Warns of ISC BIND Vulnerabilities

Published: 2026-10-22 · Severity: routine · Sectors: Telecommunications, Infrastructure
Canonical: https://vorant.io/reports/9303afe9-0df5-5dd4-8825-e2715ab5d271/cert-fr-warns-of-isc-bind-vulnerabilities

> Multiple vulnerabilities in ISC BIND allow remote code execution and denial of service; patches available.

CERT-FR has published an advisory covering three newly disclosed vulnerabilities in ISC BIND, a widely used DNS server software. The flaws affect BIND versions prior to 9.20.30 and 9.21.27, as well as BIND Supported Preview Edition prior to 9.20.30-S1. Successful exploitation could allow a remote attacker to execute arbitrary code or cause a denial of service condition on affected DNS infrastructure.

The advisory references three separate ISC security bulletins (CVE-2026-94300, CVE-2026-96888, CVE-2026-97313), all published on 21 October 2026, though no technical details of the vulnerabilities are provided in this CERT-FR summary. No in-the-wild exploitation is mentioned. Defenders operating BIND DNS servers should consult the linked ISC bulletins for patch details and upgrade affected installations to the fixed versions as soon as possible, given the critical role DNS infrastructure plays and the potential for remote code execution.

## Mentioned in this report

- Vulnerabilities: CVE-2026-94300, CVE-2026-96888, CVE-2026-97313

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1365

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/9303afe9-0df5-5dd4-8825-e2715ab5d271/cert-fr-warns-of-isc-bind-vulnerabilities.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup