CISA adds ISC BIND TKEY vulnerability to Known Exploited Vulnerabilities catalog

The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2015-5477 to its Known Exploited Vulnerabilities (KEV) catalog on October 8, 2026. The entry targets a data processing error in ISC BIND that enables remote attackers to cause a denial of service.

The vulnerability affects ISC BIND 9.x versions prior to 9.9.7-P2 and 9.10.x versions prior to 9.10.2-P3. According to the National Vulnerability Database (NVD), the flaw allows remote attackers to trigger a REQUIRE assertion failure and daemon exit by sending specific TKEY queries. The NVD assigns the vulnerability a CVSS score of 7.5, classifying it as High severity. The weaknesses associated with the flaw are identified as CWE-19 (Information Exposure Through a Directory Listing) and CWE-617 (Synchronization Error in a Threaded Environment).

Context and Background

The addition of CVE-2015-5477 to the KEV catalog mandates specific actions for federal civil executive branch agencies. CISA set a federal due date of October 11, 2026, for compliance. Stakeholders are required to apply mitigations in accordance with vendor instructions. This action must align with CISA’s Binding Operational Directive (BOD) 26-04, which focuses on prioritizing security updates based on risk.

Agencies must also adhere to CISA’s “Forensics Triage Requirements” as outlined in the catalog entry notes. For cloud services, stakeholders must follow applicable BOD 26-04 guidance. If mitigations are unavailable for a specific asset, CISA instructs stakeholders to discontinue use of the product. The catalog entry notes that the use of this vulnerability in ransomware campaigns is currently unknown.

Who is affected

Organizations running ISC BIND versions older than 9.9.7-P2 or 9.10.2-P3 are directly affected. The vulnerability allows remote attackers to disrupt service without requiring authentication. The impact is a denial of service, characterized by the failure of an internal assertion and the subsequent exit of the BIND daemon.

Security professionals must evaluate each asset’s internet exposure to determine risk. The NVD description specifies that the flaw exists in the named versions of ISC BIND 9.x. The specific mechanism involves TKEY queries, which are used for dynamic DNS key management.

What should you do?

Administrators should verify their current BIND version immediately. If running a vulnerable version, apply the vendor-provided mitigations or update to a patched version (9.9.7-P2 or later, or 9.10.2-P3 or later). Federal entities must complete this process by October 11, 2026.

Review CISA’s BOD 26-04 guidance for detailed patching procedures. Ensure compliance with forensics triage requirements if an incident occurs. If a fix is not available for a specific deployment, consider discontinuing the use of the vulnerable product or isolating it from the internet.