CVE-2026-77119

BIND 9's DNSSEC validator can mistakenly accept a validly signed NSEC3 record from an unrelated sibling zone as proof that a delegation is insecure. An attacker who can inject a crafted response into a resolver's validation process (e.g., an on-path attacker or in a cache-poisoning race) can downgrade a securely signed delegation to insecure, causing a forged, unsigned answer to be accepted and cached. The impact is DNS spoofing of validating resolvers: integrity loss only, with no confidentiality or availability effect (CVSS 5.9, CWE-346 origin validation error). Any operator running an affected BIND 9 release with DNSSEC validation enabled is affected. No public proof of concept and no known in-the-wild exploitation have been reported.

What to do: Upgrade validating resolvers to the patched BIND 9 release that fixes CVE-2026-77119 as soon as ISC publishes it (part of a 14-CVE BIND 9 disclosure; monitor ISC advisories for fixed build numbers). Until patched, restrict recursion to trusted clients and review which resolvers in your estate run affected versions with DNSSEC validation enabled. Not listed in CISA KEV and no PoC is public, but prioritize because successful abuse silently serves forged DNS records.