A replayed GSS-TSIG message can corrupt BIND 9 memory and lead to remote code execution
On 21 October 2026, ISC patched CVE-2026-94300, a remotely triggerable memory corruption in BIND 9 caused by replaying a GSS-TSIG-signed UDP message. With no workaround available, the only fix is to upgrade to 9.20.30 or 9.21.27, starting with servers that front Active Directory-integrated zones.