SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
6 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2015-5477 · CVSS 7.5

ISC BIND: attackers can knock it offline

AFFECTSISC BIND

OFFICIAL NAME: ISC BIND Data Processing Errors Vulnerability

WHAT IT IS · SERVERS AND BACKUPSIt runs or protects many systems at once, including your backups.

DO THIS FIRSTPatch it and keep its admin access off the internet. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries.

WHY THIS VERDICT Attacks are confirmed. The exploit prediction score is 100%.

WHY IT RANKS HERE Exploitation is confirmed by an authoritative source.

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
PROOF OF CONCEPT
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    ▨ REPORTED, NOT CONFIRMED
    NEWEST EVIDENCE · 1 SOURCE

    CVE-2015-5477 discussed publicly (CIRCL sighting).

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    ISC BIND contains a data processing errors vulnerability that could allow remote attackers to cause a denial of service via TKEY queries. CISA Vulnrichment marks CVE-2015-5477 as actively exploited.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2015-5477 published
  2. EXPLOIT CODE PUBLIC
    Exploit-DB
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 4089 days after disclosure. CISA listed it 4089 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Oct 11, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. Attack activity. JUL 29, 2015
    CISA Vulnrichment marks CVE-2015-5477 as actively exploited
  2. JUL 31, 2015
    7 public GitHub repositories claim a proof of concept for CVE-2015-5477
  3. JUL 31, 2015
    Exploit-DB entry: ISC BIND 9 - TKEY (PoC)
  4. AUG 4, 2015
    Exploit-DB entry: ISC BIND 9 - TKEY Remote Denial of Service (PoC)
  5. Attack activity. OCT 7, 2026
    ISC BIND Data Processing Errors Vulnerability
  6. NOV 6, 2026
    CVE-2015-5477 discussed publicly (CIRCL sighting)

SOURCES

  1. [1] CIRCL Vulnerability-Lookup sightings: CVE-2015-5477 discussed publicly (CIRCL sighting), NOV 6
  2. [2] CISA Known Exploited Vulnerabilities: ISC BIND Data Processing Errors Vulnerability, OCT 7
  3. [3] Exploit-DB: Exploit-DB entry: ISC BIND 9 - TKEY Remote Denial of Service (PoC), AUG 4
  4. [4] Exploit-DB: Exploit-DB entry: ISC BIND 9 - TKEY (PoC), JUL 31
  5. [5] PoC-in-GitHub: 7 public GitHub repositories claim a proof of concept for CVE-2015-5477, JUL 31
  6. [6] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2015-5477 as actively exploited, JUL 29