High-severity CVE-2026-94300 affects ISC BIND 9, risks remote code execution

## Overview CVE-2026-94300 is a high-severity vulnerability affecting ISC BIND 9. It allows attackers to replay GSS-TSIG signed UDP messages. This can lead to memory corruption in the `named` service. The vulnerability impacts multiple versions of BIND 9, making it critical for users to act quickly. ## Technical Details The issue arises when an attacker captures a previously signed UDP message. If the negotiated TSIG key remains valid, the attacker can replay this message. Additionally, by sending crafted queries to a zone they control, the attacker can exploit this vulnerability further. The affected versions include BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, and several specific security releases. ## Impact Successful exploitation of CVE-2026-94300 can lead to memory corruption in the `named` process. This may allow attackers to execute arbitrary code remotely. Given the potential for remote code execution, the risk is significant for organizations using affected versions of BIND 9. ## Mitigation Defenders should immediately update to the latest versions of ISC BIND 9. Patching is the most effective way to mitigate this vulnerability. Organizations should review their systems for affected versions and apply updates as soon as possible to prevent exploitation.