CVE-2026-33608

CVE-2026-33608 is a configuration corruption vulnerability in the BIND backend that allows remote attackers to exploit the notify request functionality to inject invalid secondary domain configurations. This vulnerability affects BIND DNS software and requires no authentication or user interaction to trigger. The vulnerability carries a HIGH CVSS score of 7.4, with a network-based attack vector and low-to-moderate complexity. While confidentiality is not impacted, the attack results in significant integrity and availability damage by corrupting backend configuration files and rendering the service inoperable until manual administrative intervention restores functionality. There is currently no evidence of active exploitation or public exploit code availability. The vulnerability maintains an inactive status on threat tracking lists, and the EPSS score of 0.00005 indicates extremely low probability of exploitation in the wild, suggesting this remains a theoretical concern rather than an immediate operational threat.