Will your agency patch the high-severity ISC BIND TKEY DoS flaw by Oct 11?

The Cybersecurity and Infrastructure Security Agency (CISA) has added a long-standing vulnerability in ISC BIND to its Known Exploited Vulnerabilities (KEV) catalog. The agency set a strict deadline of October 11, 2026, for federal civil executive branch agencies to apply mitigations or patches for this high-severity issue.

The vulnerability, identified as CVE-2015-5477, affects ISC BIND versions 9.x prior to 9.9.7-P2 and 9.10.x prior to 9.10.2-P3. According to the National Vulnerability Database (NVD), the flaw allows remote attackers to cause a denial-of-service condition. Specifically, malicious TKEY queries can trigger a REQUIRE assertion failure, causing the BIND daemon to exit and disrupting DNS resolution services. The NVD rates the severity at 7.5 on the CVSS scale, categorizing it as high.

Context and Background

CISA added CVE-2015-5477 to the KEV catalog on October 8, 2026. This addition signals that the agency considers the vulnerability actively relevant to national security, even though the ransomware usage status remains unknown. The inclusion triggers mandatory action under Binding Operational Directive (BOD) 26-04, which requires federal entities to prioritize security updates based on risk. Organizations must also adhere to CISA’s forensics triage requirements to assess any potential compromise.

Who Is Affected

Federal civil executive branch agencies are the primary entities bound by the October 11 deadline. However, the directive notes that stakeholders are responsible for evaluating the internet exposure of each asset. This implies that any organization running affected versions of ISC BIND on internet-facing systems faces significant operational risk. The directive also addresses cloud services, requiring compliance with BOD 26-04 guidance or discontinuation of the product if mitigations are unavailable.

Next steps

Federal agencies must immediately verify their BIND versions and apply vendor-provided instructions to mitigate the risk. If patching is not feasible, agencies must follow CISA’s guidance on discontinuing use or implementing compensating controls. Non-federal organizations should also review their DNS infrastructure, as the high severity score indicates a tangible threat to service availability.

Background: Ransomware

Ransomware protection combines network segmentation, strict least-privilege access, and immutable backups to prevent encryption malware from spreading. You must detect initial access vectors like phishing or unpatched services, isolate infected systems immediately, and restore data from offline copies that attackers cannot modify or delete.

Read the full guide: What Is Ransomware Protection: How to Stop Encryption Attacks

What to do and how to stay safe: ISC BIND

• Audit all DNS servers to identify if they are running ISC BIND 9.x before 9.9.7-P2 or 9.10.x before 9.10.2-P3.
• Restrict access to TKEY queries at the firewall level if immediate patching is not possible.
• Monitor server logs for unexpected daemon exits or assertion failures that may indicate exploitation attempts.
• Once the vendor provides an update, apply the patch promptly to eliminate the vulnerability.

Step-by-step guide: Emergency Patching Checklist for Critical System Fixes

General security guidance from the SecOps Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the deadline for federal agencies to fix CVE-2015-5477?

Federal agencies must apply mitigations by October 11, 2026, in accordance with CISA’s KEV catalog entry.

Which versions of ISC BIND are affected by this vulnerability?

The flaw affects ISC BIND 9.x versions before 9.9.7-P2 and 9.10.x versions before 9.10.2-P3.

What is the severity rating of CVE-2015-5477?

The National Vulnerability Database assigns a CVSS score of 7.5, which is classified as high severity.