Unbound 1.26.1 Patches Critical DNSSEC Validator Flaw CVE-2026-81642 Enabling Remote Code Execution
NLnet Labs has released Unbound version 1.26.1 to address CVE-2026-81642, a critical flaw in its DNSSEC validator that carries risks of service disruption and potential remote code execution. The vulnerability impacts all versions through 1.26.0 and activates when the resolver processes a malicious DNS zone.
The issue lies in the DNSSEC validator during handling of DNSKEY records. Specifically, the code can experience a buffer overflow when managing data from incoming DNS responses, a scenario made more serious because the traffic arrives over the network and the process typically runs continuously.
The vendor assigned the vulnerability a CVSS 4.0 score of 9.1, with a network vector, no privileges required, and no user interaction. An attacker must control a malicious DNS zone and cause the vulnerable resolver to query it. This can occur if the resolver accepts queries from untrusted networks, resolves for external users, or is tricked into querying the attacker-controlled domain.
In the worst scenario, the manipulated input can not only trigger denial of service but also open the door to remote code execution using data controlled by the attacker. No active exploitation in the wild had been observed at the time of disclosure.
Unbound 1.26.1 adds a proper buffer capacity check after decompression and before writing data. The release also bundles eight additional security fixes, including CVE-2026-82717 involving heap corruption during CNAME synthesis and CVE-2026-81634 related to possible heap overflow during DNSSEC canonicalization.
Administrators are advised to update to Unbound 1.26.1 immediately. Where immediate updates are not possible, apply the official patch for CVE-2026-81642, recompile, and plan full adoption of all fixes. Organizations should also inventory Unbound instances in appliances, containers, and distribution packages to confirm the running version includes the equivalent patch.
Related articles
BIND DNS Servers Receive Patches for 14 Vulnerabilities Including High-Severity DoS Flaws
The Internet Systems Consortium has released BIND 9 updates that address 14 vulnerabilities across multiple versions of the widely used DNS server software. Seven of the issues received a CVSS score of 7.5 and were rated high severity, while the remaining seven scored between 5.3 and 6.5. The most critical flaw allows an unauthenticated attacker to crash the named process with a single malformed SIG(0) request over DNS over HTTPS. Additional vulnerabilities enable cache poisoning through forged NXDOMAIN responses, downgraded secure delegations, and acceptance of unsigned answers, as well as resource exhaustion via uncontrolled cache growth and excessive CPU consumption. Affected releases span BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, and 9.21.0 through 9.21.25. No workarounds exist, making immediate upgrades to versions 9.20.29, 9.21.26, or 9.20.29-S1 the only mitigation. The ISC reports no known exploitation in the wild and none of the flaws appear in CISA’s Known Exploited Vulnerabilities catalog.
Cisco Patches 29 Vulnerabilities in Secure Firewall ASA, FTD and FMC Products
Cisco Systems has disclosed multiple vulnerabilities affecting its Cisco Secure Firewall product line and released corresponding security updates. The advisory covers 14 security bulletins addressing 29 CVEs across Adaptive Security Appliance (ASA), Threat Defense (FTD), and Management Center (FMC) software. Five of the advisories are rated Critical, covering 18 CVEs that include remote code execution without authentication and privilege escalation to administrator level. Several issues have already been confirmed as exploited in the wild. The company also consolidated related weaknesses under single CVE identifiers where appropriate and provided CVSS v3.1 base scores ranging up to 9.9. Affected products include the Secure Firewall 3100 and 4200 Series along with multiple software hardening releases issued on 16 September 2026.
pgAdmin 4 Database Management Tool Patches Multiple Vulnerabilities in Version 9.18
The development team behind pgAdmin 4, the popular management tool for PostgreSQL databases, has released version 9.18 to address multiple security issues. The update, published on September 17, 2026, includes fixes for four CVEs along with 29 total changes covering new features and bug resolutions. One vulnerability, tracked as CVE-2026-86863, stems from insufficient web server authentication that trusts external HTTP headers, enabling attackers to bypass login and impersonate administrators without passwords. A second issue, CVE-2026-86864, allows command injection through the backup feature when database names are passed as arguments, potentially leading to unauthorized file writes or exfiltration of connection passwords. The update is available now from the official pgAdmin repository.
Cisco Issues Emergency Patches for Critical ISE Zero-Day CVE-2026-76460 Already Exploited in Attacks
Cisco has released emergency patches for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) to address CVE-2026-76460, a maximum-severity zero-day with a CVSS score of 10.0. The vulnerability stems from insufficient authentication controls in an API endpoint, allowing remote attackers to bypass authentication entirely without credentials. Active exploitation has been confirmed, enabling unauthorized access to the API gateway and potential root-level command execution when chained with further actions. The flaw affects all configurations of ISE and ISE-PIC, with no available workarounds, forcing organizations to apply updates immediately. Patches are available for branches 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4, while version 3.0 has reached end of software maintenance. Administrators are advised to review ise-kong access.log and node access logs for suspicious usernames and cross-reference with perimeter and firewall logs. In cases of confirmed compromise, affected nodes should be reinstalled and restored from backups, with iACLs recommended to restrict management traffic during rollout.