Act now: Apply BIND mitigations by Oct 11 to comply with CISA's KEV listing mandate

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a strict deadline for federal agencies to address a long-standing denial-of-service vulnerability in ISC BIND. Added to the Known Exploited Vulnerabilities (KEV) catalog on October 8, 2026, CVE-2015-5477 requires compliance by October 11, 2026. This addition signals that the agency considers the flaw actively relevant to national security infrastructure, demanding immediate attention from IT leaders responsible for DNS infrastructure.

The risk

CVE-2015-5477 is classified as a high-severity vulnerability with a CVSS score of 7.5. According to the National Vulnerability Database (NVD), the flaw exists in ISC BIND 9.x versions prior to 9.9.7-P2 and 9.10.x versions prior to 9.10.2-P3. The vulnerability stems from data processing errors related to TKEY queries.

When an attacker sends a specifically crafted TKEY query to a vulnerable server, it triggers a REQUIRE assertion failure. This failure causes the BIND daemon to exit unexpectedly, resulting in a denial of service. Because DNS is critical for network connectivity and application availability, this crash can disrupt business operations and user access to internal and external resources.

Who is exposed

Organizations running affected versions of ISC BIND are at risk. Specifically, any deployment of BIND 9.x before 9.9.7-P2 or 9.10.x before 9.10.2-P3 is susceptible to this remote attack. The NVD identifies the underlying weaknesses as CWE-19 (Information Exposure Through a Directory Listing) and CWE-617 (Synchronization Error), though the primary impact described is the service crash. Stakeholders must evaluate the internet exposure of each asset running these versions. Even if the servers are not directly facing the public internet, internal networks can be targeted if lateral movement is possible or if internal DNS resolvers are misconfigured.

Cost and compliance

For federal agencies, the cost of inaction is non-compliance with CISA’s Binding Operational Directive (BOD) 26-04, which prioritizes security updates based on risk. The required action is to apply mitigations in accordance with vendor instructions. If mitigations are unavailable, agencies must discontinue the use of the product.

CISA also references its "Forensics Triage Requirements," implying that any incident response must adhere to specific data preservation standards. The date added to the KEV catalog is October 8, 2026, with a federal due date of October 11, 2026. While ransomware use is currently listed as unknown, the KEV listing itself mandates prioritization regardless of current exploitation trends.

Our take on the response

Business leaders should treat this KEV addition as a critical operational risk, not just a compliance checkbox. The short window between the catalog addition and the deadline requires immediate inventory checks. Prioritize servers with high internet exposure, as they are the most likely targets for remote TKEY queries.

Background: Incident response plans

An incident response plan for cyber attack is a predefined set of instructions that dictates how your team detects, contains, and recovers from security events. It reduces decision fatigue during crises, limits financial damage, and ensures legal compliance by assigning clear roles and communication protocols before any threat materializes.

Read the full guide: Incident Response Plan for Cyber Attack: Structure and Execution

What to do and how to stay safe: ISC BIND

• Audit your DNS infrastructure to identify any servers running ISC BIND versions prior to 9.9.7-P2 or 9.10.2-P3.
• Review network logs for unusual TKEY query traffic to detect potential exploitation attempts.
• Apply vendor-provided mitigations or patches immediately, ensuring alignment with your organization's change management process.
• If a patch is not immediately available, consider restricting access to the DNS service through firewall rules to limit exposure to untrusted networks.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of ISC BIND are affected by CVE-2015-5477?

ISC BIND 9.x versions before 9.9.7-P2 and 9.10.x versions before 9.10.2-P3 are affected.

What is the deadline for federal agencies to mitigate this vulnerability?

The federal due date is October 11, 2026.

What is the CVSS score for this vulnerability?

The CVSS score is 7.5, which is rated as HIGH severity.