CVE-2026-10723 ISC CVE debrief

Who should care

Organizations using BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1 should review and apply patches to prevent potential DNS response forgery. Operators, security teams, and administrators of affected systems should prioritize patching and verify DNS server configurations.

Technical summary

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. The vulnerability allows for DNS response forgery. Organizations should review and apply patches to prevent potential DNS response forgery. Limited source detail is available, so evidence limits and defensive verification tasks are emphasized. Evidence is based on official CVE and NVD records, as well as references from the Internet Systems Consortium (ISC). Defensive priority is medium due to potential for DNS response forgery.

Defensive priority

Medium priority due to potential for DNS response forgery. Organizations should focus on patching affected systems and monitoring DNS traffic.

Recommended defensive actions

• Review and apply patches for affected BIND versions
• Verify DNS server configurations for potential vulnerabilities
• Monitor DNS traffic for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is based on official CVE and NVD records, as well as references from the Internet Systems Consortium (ISC). The CVE record was published on 2026-07-22T15:16:51.190Z and has not been modified since then. Limited source detail is available, so evidence limits and defensive verification tasks are emphasized.

Official resources