ZoomEye counts 19.4M BIND hosts amid four ISC vulnerabilities

ISC patched four BIND 9 flaws with CVSS up to 8.1 on October 21, including a GSS-TSIG memory corruption that can lead to RCE. ZoomEye found 19,459,958 assets with a BIND fingerprint, but scans cannot reveal version, server role or GSS-TSIG configuration. The 9.18 branch has no fixed release.

• CVE-2026-94300 (CVSS 8.1) requires capturing a signed GSS-TSIG message
• Fixes shipped in 9.20.30 and 9.21.27; 9.18 has no patch
• CVE-2026-97313 and CVE-2026-96888 depend on RPZ and QNAME minimisation config
• ISC reports no active exploits and lists no workarounds