The vulnerability CVE-2026-13321 in ISC BIND 9 arises from the resolver accepting NSEC DNS records that are validly signed but contain a "Next Domain Name" field referencing a domain outside the signer's zone. This constitutes an origin validation error (CWE-346). Affected versions include 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, and specific S1 builds. The CVSS 3.1 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and a scope change. The impact is high on integrity but no confidentiality or availability impact is noted. No vendor advisory or patch information is currently available, and no known exploits in the wild have been reported.

The vulnerability allows an attacker to exploit the origin validation error by providing validly-signed NSEC records with a "Next Domain Name" field pointing outside the signer's zone. This can lead to a high impact on data integrity within the DNS resolver, potentially allowing manipulation or spoofing of DNS responses. There is no direct impact on confidentiality or availability reported. The scope of the vulnerability affects the DNS resolution process in the affected BIND 9 versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor ISC communications for updates. Until a patch is available, consider applying any recommended workarounds from ISC if published. Avoid relying on affected versions in sensitive environments where DNS integrity is critical.