18 September 2026
Reference: CVE-2026-81642
1. What is being reported?
The vulnerability is in the DNSSEC validator part of Unbound software, which is used to check the authenticity of internet addresses. A specially crafted malicious DNS entry can cause the software to crash or allow attackers to run harmful code remotely.
2. What this means in plain English
If your organisation uses Unbound DNS software, attackers could potentially disrupt your internet services or gain control over your systems. This could lead to downtime, data loss, or further security breaches.
3. Could this affect a small business?
Small businesses and organisations that use Unbound DNS software, either directly or through their internet service provider, could be affected. Those not using this software or relying on managed services may be less at risk but should still check.
4. What to do now
- Check if your organisation uses Unbound DNS software or if your internet provider uses it on your behalf.
- Ask your IT provider or software supplier if they have applied the latest security updates to fix this vulnerability.
- If you manage your own DNS servers with Unbound, update the software to the latest version immediately.
- Monitor your systems for unusual activity and be prepared to respond to any service disruptions.
5. Ask your IT provider
Can you confirm whether our DNS services use Unbound software and if the critical security update for CVE-2026-81642 has been applied?
6. Bottom line
Make sure your DNS software is updated promptly to prevent hackers from disrupting your services or taking control.
Information based on CISA KEV, NVD and reputable security reporting.