Patch ISC BIND TKEY flaw before CISA’s 11 October deadline

Security teams must immediately verify their ISC BIND versions and apply mitigations for CVE-2015-5477. The Cybersecurity and Infrastructure Security Agency (CISA) added this long-standing flaw to its Known Exploited Vulnerabilities (KEV) catalog on 8 October 2026. The agency has set a federal due date of 11 October 2026 for compliance, marking a narrow window for government IT departments to act.

The inclusion in the KEV catalog signals that this vulnerability is being actively exploited in the wild. While the specific ransomware usage remains unknown, the potential for denial of service poses a significant risk to DNS infrastructure. Organisations must assess their internet exposure and ensure adherence to CISA’s Binding Operational Directive (BOD) 26-04, which prioritises security updates based on risk.

What is CVE-2015-5477 and how does it work?

CVE-2015-5477 is a data processing errors vulnerability within the ISC BIND DNS software. According to the National Vulnerability Database (NVD), the flaw allows remote attackers to cause a denial of service. This is achieved by sending specially crafted TKEY queries to the server.

The attack results in a REQUIRE assertion failure, which forces the BIND daemon to exit. This effectively takes the DNS server offline, disrupting name resolution for any systems relying on it. The NVD rates the severity of this vulnerability as HIGH, with a CVSS score of 7.5. The underlying weaknesses are classified as CWE-19 (Information Exposure Through a Directory Listing) and CWE-617 (Synchronous External Control Flow).

Which versions of BIND are affected?

The vulnerability impacts specific older versions of ISC BIND. According to the NVD record, BIND 9.x versions prior to 9.9.7-P2 are vulnerable. Similarly, BIND 9.10.x versions prior to 9.10.2-P3 are affected.

Organisations running these legacy versions are at risk. Even if the software has not been updated recently, the presence of these versions in a network environment creates an attack surface. IT teams must inventory their DNS infrastructure to identify any instances of these vulnerable releases. If an asset is internet-facing, the risk is significantly higher, as remote attackers can exploit the flaw without prior authentication.

What is the required action for federal agencies?

CISA has mandated that federal stakeholders apply mitigations in accordance with vendor instructions. This action must be taken to ensure compliance with CISA’s BOD 26-04, which focuses on prioritising security updates based on risk. The directive also references CISA’s “Forensics Triage Requirements,” implying that agencies should be prepared to investigate potential compromises.

For cloud services, stakeholders must follow applicable BOD 26-04 guidance. If mitigations are unavailable for a particular product or service, CISA advises discontinuing its use. Each asset’s internet exposure must be evaluated individually. Failure to adhere to the patching guidelines by the 11 October 2026 deadline could result in non-compliance with federal security standards.

What should private sector organisations do?

Although the BOD 26-04 applies specifically to federal agencies, the addition of CVE-2015-5477 to the KEV catalog serves as a strong indicator for the private sector. CISA’s KEV list is designed to highlight vulnerabilities that are known to be exploited, regardless of the sector.

Private organisations should treat this with high priority. IT teams should check their BIND versions against the affected list. If running a vulnerable version, they should apply the vendor’s recommended mitigations or upgrade to a patched version immediately. If a patch is not available or feasible, organisations should consider discontinuing the use of the vulnerable product or implementing strict network controls to limit exposure to TKEY queries.

What to do and how to stay safe: ISC BIND

• Speed compromises stability, often breaking dependent systems or user workflows.
• Only patch exposed, unauthenticated vulnerabilities immediately to reduce immediate risk.
• Automated testing cannot replace human review when deploying unvetted emergency fixes.

Emergency patching stops active exploitation but risks system stability, so reserve it for unauthenticated, internet-facing flaws. Test every patch in isolation first, even under pressure, to prevent cascading failures.

Step-by-step guide: Emergency Patching: The High Cost of Fixing Critical Flaws Fast

General security guidance from the DarkWeb Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2015-5477?

The NVD rates CVE-2015-5477 as HIGH severity with a CVSS score of 7.5.

Which BIND versions are not affected by this vulnerability?

BIND 9.x versions 9.9.7-P2 and later, and BIND 9.10.x versions 9.10.2-P3 and later are not affected.

Is there a confirmed ransomware group exploiting this flaw?

No, CISA lists the ransomware use for CVE-2015-5477 as Unknown.