CVE-2026-10723 describes a vulnerability in ISC BIND 9 where the software may improperly verify cryptographic signatures related to child-zone NSEC3 records. This flaw allows BIND to accept incorrect NSEC3 records as valid, which could be exploited by an attacker to forge authenticated NXDOMAIN DNS responses. The vulnerability affects specific versions of BIND 9, including 9.18.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and S1 variants 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.24-S1. The CVSS 3.1 base score is 6.8, with attack vector network, high attack complexity, no privileges required, no user interaction, scope changed, no confidentiality impact, high integrity impact, and no availability impact. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

An attacker could exploit this vulnerability to forge authenticated NXDOMAIN responses by presenting incorrect child-zone NSEC3 records as valid. This compromises the integrity of DNS responses, potentially misleading DNS clients about the non-existence of domain names. There is no direct confidentiality or availability impact reported. The integrity impact is high due to the potential for forged DNS responses.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor ISC advisories for updates. Until a patch is available, consider mitigating risk by restricting exposure of vulnerable BIND instances and applying DNSSEC validation policies carefully. Avoid relying solely on vulnerable versions for critical DNS validation.