ISC BIND Data Processing Errors — exploitable from the network with no login

What it is

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

Why it matters

• CISA added it to the Known Exploited Vulnerabilities catalogue on October 8, 2026 — observed exploitation, on the record.
• EPSS puts the chance of exploitation in the next 30 days at 99.4% — the top 0.1% of all scored CVEs.
• CVSS 7.5 (high), and it is reachable over the network, needs no credentials, needs no user interaction.

What to do

• Patch it. CISA's deadline for federal agencies was October 11, 2026 and has already passed.
• Check CISA's advisory for affected versions: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-5477

---

Drafted from CVE-2015-5477 — CISA KEV, NVD, FIRST EPSS. Check before publishing.