How Can Federal Agencies Prevent BIND Crashes by Oct 11 Under CISA's New KEV Mandate?
The US government requires federal agencies to mitigate a high-severity ISC BIND vulnerability by October 11 to prevent remote server crashes.
Key points
- CISA added CVE-2015-5477 to its Known Exploited Vulnerabilities catalog on October 8, 2026.
- The flaw allows remote attackers to crash BIND servers using specific TKEY queries.
- Federal agencies must apply mitigations or discontinue use by the October 11 deadline.
The Cybersecurity and Infrastructure Security Agency (CISA) has added a long-standing vulnerability in ISC BIND to its Known Exploited Vulnerabilities (KEV) catalog. This action triggers a mandatory mitigation deadline for federal agencies, requiring them to address the issue by October 11, 2026. The vulnerability, tracked as CVE-2015-5477, is a data processing error that enables remote attackers to cause a denial of service.
Root cause
The issue stems from how specific versions of ISC BIND handle TKEY queries. According to the National Vulnerability Database (NVD), the flaw is classified under CWE-19 (Information Exposure Through a Directory Listing) and CWE-617 (Synchronization Error in a Threaded Environment). When the server processes these queries, it can trigger a REQUIRE assertion failure. This internal error forces the BIND daemon to exit unexpectedly, effectively crashing the DNS service.
Attack path
Attackers can exploit this vulnerability remotely. By sending crafted TKEY queries to an affected BIND server, they can trigger the assertion failure without needing prior authentication or user interaction. The result is a denial of service condition where the daemon exits, rendering the DNS server unavailable to legitimate users. CISA notes that while ransomware use of this specific CVE is currently unknown, the ability to crash critical infrastructure components poses a significant risk.
Affected versions
The vulnerability impacts older versions of the software. Specifically, ISC BIND 9.x versions prior to 9.9.7-P2 are affected. Additionally, versions in the 9.10.x branch prior to 9.10.2-P3 contain this flaw. Organizations running these specific legacy versions are at risk of remote server crashes.
Mitigation
CISA requires stakeholders to apply mitigations in accordance with vendor instructions. This must align with CISA’s Binding Operational Directive (BOD) 26-04, which prioritizes security updates based on risk. Agencies must also follow CISA’s forensics triage requirements. If mitigations are unavailable, the directive states that agencies must discontinue use of the product. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to these patching guidelines. For cloud services, applicable BOD 26-04 guidance must be followed.
What to do and how to stay safe: ISC BIND
- Inventory your DNS infrastructure to identify if any servers are running ISC BIND versions prior to 9.9.7-P2 or 9.10.2-P3.
- Review your network logs for unusual TKEY query traffic that could indicate exploitation attempts.
- Consult your vendor’s documentation for specific mitigation steps if you cannot immediately upgrade the software.
- Monitor official CISA alerts for updates on the status of this vulnerability and any new exploitation trends.
Step-by-step guide: Patch Testing Best Practices That Prevent Production Failures
General security guidance from the CloudSec Press newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the deadline for federal agencies to fix this?
Federal agencies must mitigate the vulnerability by October 11, 2026, according to CISA.
Is this vulnerability rated as critical?
No, the NVD rates CVE-2015-5477 as high severity with a CVSS score of 7.5.
Can attackers use this to install ransomware?
CISA currently lists ransomware use for this specific CVE as unknown.
