PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-40012 PowerDNS CVE debrief

A vulnerability in ECS zero scoped answers being stored in the packet cache impacts configurations with ECS enabled. Defenders should assess exposure, particularly those managing DNS resolvers or networks using PowerDNS. The vulnerability's consequences and remediation require verification from official sources. To address this vulnerability, defenders should confirm whether affected product deployments exist in managed environments and assign an owner for follow-up. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Vendor
PowerDNS
Product
Recursor
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-25
Original CVE updated
2026-10-25
Advisory published
2026-06-25
Advisory updated
2026-10-25

Who should care

Defenders managing DNS resolvers or networks using PowerDNS should assess exposure and prioritize remediation. This includes operators of affected systems, platform administrators, vulnerability management teams, and security teams responsible for ensuring the security and integrity of DNS infrastructure.

Why it matters

A vulnerability in ECS zero scoped answers being stored in the packet cache impacts configurations with ECS enabled. Defenders should assess exposure, particularly those managing DNS resolvers or networks using PowerDNS. The vulnerability's consequences and remediation require verification from official sources.

  • Verify configurations for ECS usage and potential exposure
  • Assess and prioritize remediation for affected DNS systems

Technical summary

The CVE record describes a vulnerability where ECS zero scoped answers are stored in the packet cache, impacting configurations with ECS enabled. The CVSS score is 5.3, with a medium severity. This vulnerability affects DNS systems using ECS, particularly those managed by PowerDNS. Defenders should verify configurations, assess exposure, and prioritize remediation for affected systems.

Defensive priority

Verify configurations, assess exposure, and prioritize remediation for DNS systems using ECS

Recommended defensive actions

  • Verify DNS configurations for ECS usage
  • Assess exposure of DNS systems using PowerDNS
  • Prioritize remediation for affected systems

Evidence notes

The CVE record and NVD entry provide limited information on the vulnerability's impact and remediation. Further verification is required from official sources, such as PowerDNS.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-40012 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-40012

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-40012 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-40012

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.