CVE-2026-10723

MediumCVSS 6.8/10Last modified Nov 2, 2026

Description

BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses. This issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
ISC	BIND 9	>= 9.18.0, <= 9.18.50; >= 9.20.0, <= 9.20.24; >= 9.21.0, <= 9.21.23; >= 9.11.3-S1, <= 9.18.50-S1; >= 9.20.9-S1, <= 9.20.24-S1

References

https://downloads.isc.org/isc/bind9/9.20.26Product
https://downloads.isc.org/isc/bind9/9.21.24Product
https://kb.isc.org/docs/cve-2026-10723Vendor Advisory

Timeline

Published: Jul 22, 2026
Last modified: Nov 2, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1072307.4The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2 CVE-2026-1072318.7The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior CVE-2026-1072327.5The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior CVE-2026-1072378.2The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that de CVE-2026-1072388.7A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running t CVE-2026-1072398.8A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers runni CVE-2026-107244.8The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rend CVE-2026-1072407.6The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is no CVE-2026-1072417.6The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is no CVE-2026-1072429.1The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is no CVE-2026-1072437.6The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is no CVE-2026-1072447.6The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is no