Zero Day MonitorZDM

← Back to list

8.6

CVE-2026-13321PATCHED

isc · bind

DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field

Description

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Affected Products

Vendor	Product	Versions
isc	bind	9.11.0, 9.20.0, 9.21.0, 9.11.3-S1, 9.20.9-S1

Also Affects

Downstream vendors/products affected by this vulnerability

Vendor	Product	Source	Confidence
debian	debian linux	cert_advisory	90%
internet systems consortium	bind	cert_advisory	90%

References

https://kb.isc.org/docs/cve-2026-13321(vendor-advisory)
https://downloads.isc.org/isc/bind9/9.20.26(patch)
https://downloads.isc.org/isc/bind9/9.21.24(patch)

Related News (4 articles)

Tier B

BSI Advisories34d ago

[NEU] [hoch] Internet Systems Consortium BIND: Mehrere Schwachstellen

→ No new info (linked only)

Tier B

CCCS Canada35d ago

ISC BIND security advisory (AV26-732)

→ No new info (linked only)

Tier C

oss-security35d ago

ISC has disclosed nine vulnerabilities in BIND 9 (CVE-2026-10723, CVE-2026-10822, CVE-2026-11331, CVE-2026-11605, CVE-2026-11622, CVE-2026-11721, CVE-2026-12617, CVE-2026-13204, CVE-2026-13321)

→ No new info (linked only)

Tier C

VulDB35d ago

CVE-2026-13321 | ISC BIND up to 9.20.24-S1 Resolver input validation

→ No new info (linked only)

CVSS 3.18.6 HIGH

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

CISA KEV❌ No

Actively exploited❌ No

Patch available

https://kb.isc.org/docs/cve-2026-13321 https://downloads.isc.org/isc/bind9/9.20.26 https://downloads.isc.org/isc/bind9/9.21.24

CWECWE-346

PublishedJul 22, 2026

Last enriched35d agov2

Trending Score2

Source articles4

Independent4

Info Completeness9/14

Missing: epss, kev, exploit, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

HIGHCVE-2026-11622

Potential memory usage beyond configured limits

HIGHCVE-2026-11721

Cache poisoning possible with label count discrepancy, RRSIG, and wildcards

HIGHCVE-2026-13204

Unexpected exit in certain situations with NSEC and NSEC3 both present

HIGHCVE-2026-11605

Unnecessary validation of DNSSEC signed records

HIGHCVE-2026-12617

Record ordering based unexpected exit with CNAME or DNAME

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Jul 22, 2026

Discovered by ZDM

Jul 22, 2026

Updated: affectedVersions

Jul 22, 2026

Patch Available

Jul 22, 2026

Version History

v2

Last enriched 35d ago

v2Tier B35d ago

Added two previously unlisted affected BIND Supported Preview Edition versions: 9.16.8-S1 through 9.18.50-S1 and 9.18.11-S1 through 9.18.50-S1.

affectedVersions

via CCCS Canada

v135d ago

Initial creation