While everyone patches Cisco, Unbound shipped a 9.1 in the resolver you forgot you run

Thursday's loud news is Cisco again. Identity Services Engine scored a perfect 10 (CVE-2026-76460), already exploited, and the Secure Email Gateway patch from Monday is due for federal shops today. CISA also listed an Acronis backup plugin. A small hospital in Nipigon is on paper procedures. Those are the headlines. The story a mid-size Canadian shop will miss is sitting in DNS.

NLnet Labs shipped Unbound 1.26.1 after disclosing CVE-2026-81642. Every release through 1.26.0 is affected. The DNSSEC validator can overflow a heap buffer while digesting a DNSKEY. The maintainer calls it Critical. Their CVSS is 9.1. Denial of service is the floor. Remote code execution is on the table if the attacker controls a malicious zone and can get your resolver to ask about it.

Why this is quieter than ISE and more common than you think

Unbound is the recursive resolver on a lot of firewalls and Linux boxes that nobody put in the "patch this week" meeting. pfSense, OPNsense, small ISP recursives, a Pi in a closet that the office still uses as DNS. It answers queries. It is supposed to be boring.

DNSSEC validation is the feature you turn on so you can trust answers. The bug is in that path. A DNSKEY whose owner name is a compression pointer into its own record data can write past the digest buffer. Yuqi Qiu and Xiang Li at Nankai University's AOSP Lab reported it on August 11. The fix checks capacity after decompression and before the write. That is the whole patch story. You do not need a public exploit to decide to upgrade a resolver that talks to the internet.

The same 1.26.1 release closes eight other issues. One of them, CVE-2026-82717, is heap corruption in CNAME synthesis. NLnet Labs says that one can also reach code execution under some builds. If you are already opening a change window, take the whole release, not a cherry-pick.

The rest of Thursday, in one paragraph

ISE is network access control. If that API bypass becomes root, the attacker is next to the system that decides who is on the LAN. Hunt logs outside the appliance. Acronis CVE-2026-87886 is a Linux privilege escalation in the cPanel backup plugin, already used in targeted attacks. If the plugin that writes copies is the hole, the last copy is not a last copy. Nipigon District Memorial Hospital confirmed ransomware, closed outpatient lab and imaging, and said some files that may hold health information were encrypted. That is recoverability with a waiting room. We wrote those three up separately this morning.

What we would check before the weekend

• Find Unbound. unbound -V on Linux. Package version on the firewall. Anything 1.26.0 or older is in scope.
• Upgrade to 1.26.1, or to the vendor package that absorbed it. Recursives that face the internet first.
• If you cannot move today, know that "we do not do DNSSEC" may not save you if validation is on by default. Check the config you actually run.
• While you are looking at infrastructure, finish ISE and the email gateway if those are yours. Two Cisco management-plane emergencies in one week is the change calendar talking, not a coincidence.
• If you host customer sites on cPanel with Acronis, the plugin build is 1.9.3.1021 or later. Then prove a restore.

Bottom line

A 10.0 on ISE will get the meeting. A 9.1 on the resolver you forgot you run is how Thursday becomes an incident in October. Forensic Five reviews what is actually reachable, including the boring boxes. From St. Albert, Alberta. Check the Unbound version. Then go back to Cisco.