CVE-2015-5477: ISC BIND Data Processing Errors Vulnerability

RBRecent Breaches Vulnerability Intelligence·Oct 8, 2026

CVSS 7.5 · High⚠ Actively exploited (CISA KEV)

7.5

CVSS score

High

Severity

Active

CISA KEV

Ransomware use

Oct 11, 2026

Patch deadline

⚠ Exploited in the wild. CISA added CVE-2015-5477 to its Known Exploited Vulnerabilities catalog on Oct 8, 2026, with a federal patch deadline of Oct 11, 2026 — meaning attackers are actively using it. If you run the affected software, patch it immediately.

named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

Details

AffectedISC · BIND

WeaknessCWE-19

CVSS base score7.5 (High)

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

PublishedJul 29, 2015

Added to CISA KEVOct 8, 2026

Federal patch deadlineOct 11, 2026

Known ransomware useNot documented

Check if your data is exposed →

Frequently asked questions

Is CVE-2015-5477 being actively exploited?

Yes — CISA lists CVE-2015-5477 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.

What does CVE-2015-5477 affect?

CVE-2015-5477 affects ISC · BIND.

How do I fix CVE-2015-5477?

Apply the vendor’s patch for the affected software. The federal patch deadline was Oct 11, 2026. Then check whether your personal data was exposed in any related breach.

References

Official records: NVD · CISA KEV

← All actively-exploited vulnerabilities