Back to Security Advisories

Bind CVE-2026-94300

CVE-2026-94300 is a race-condition vulnerability (CWE-362) in BIND, rated CVSS 8.1 and documented by ISC. It was raised on the DirectAdmin forum for investigation: since BIND on DirectAdmin servers is typically the distribution-packaged version, the practical fix is your OS's BIND package update rather than a DirectAdmin component.

High 8.1 CVSS
DirectAdmin

Default Update CMD

cd /usr/local/directadmin/custombuild && ./build update_versions

What this means under a SharedLicense license

Race conditions in a DNS resolver/authoritative server can crash named or corrupt resolution state — and every domain the server hosts depends on that DNS service staying correct.

@DirectAdmin Support,

Could you please investigate the following security vulnerability and check whether it affects DirectAdmin or any of its supported configurations?

https://kb.isc.org/docs/cve-2026-94300

Most likely it will be a distro distributed package i believe but just to bring it to your attention.

Frequently Asked Questions

What is CVE-2026-94300?
It is a vulnerability in ISC BIND (a race condition, CWE-362) rated CVSS 8.1 and documented in ISC's knowledge base. It was brought to DirectAdmin's attention on the forum because BIND ships with DirectAdmin server stacks — though usually as the OS's distributed package.
Does DirectAdmin itself contain the flaw?
DirectAdmin manages BIND but does not ship its own BIND build in typical configurations — the forum thread notes the affected component is most likely the distribution-distributed package. That means the fix arrives through your OS repository, not CustomBuild.
How do I patch BIND on a DirectAdmin server?
Update the OS package: on RHEL-family systems run dnf update bind (or yum update bind), on Debian/Ubuntu apt update && apt upgrade bind9, then restart the named service. Check ISC's advisory (kb.isc.org/docs/cve-2026-94300) for affected version details.
How severe is CVE-2026-94300?
CVSS 8.1 — the top of the High band — with a race-condition (concurrency) root cause. No CVSS vector or exploitation status is listed in the data available so far; treat the package update as important on any server running public DNS.

References

Security Advisories

Related Advisories

Roundcube 1.7.5 / 1.6.20 security updates

2026-10-19

Kernel / KVM escape (CVE-2026-99999)

2026-10-17

Exim CVE < 4.100.1

2026-09-18

Check your system for vulnerabilities

Select your product and operating system to see the exact fix commands that apply to you.

Check Your System