DNS dependencies deserve their own applicability check. Microsoft added four BIND records to its Azure Linux guidance on October 30, 2026; upstream disclosure was October 21.
Microsoft lists Azure Linux 3.0 bind 9.20.26-1 for CVE-2026-94300, CVE-2026-19630, CVE-2026-96888 and CVE-2026-97313. Fixed RPM fields and download links are blank. This does not establish impact on Windows DNS, managed Azure DNS or every Azure workload.
Vendor ratings: Microsoft Important; ISC High. CVSS 3.1: 94300 is 8.1; the other three are 7.5. Suggested MSP priority: high when the affected resolver or GSS-TSIG path is present.
94300 can corrupt named memory when captured GSS-TSIG-signed UDP messages are replayed while their negotiated key remains valid; queries to an attacker-controlled zone may additionally enable code execution. 19630 permits disproportionate CPU/memory consumption through structured inbound DNS messages to a resolver. 96888 requires both a redirect zone and strict QNAME minimization. 97313 requires recursion and at least two RPZ zones with differing recursive-only settings.
ISC affected ranges for 94300/19630: 9.11.0–9.18.50, 9.20.0–9.20.29, 9.21.0–9.21.26; preview 9.11.3-S1–9.18.50-S1 and 9.20.9-S1–9.20.29-S1. For 96888/97313, the ordinary older range starts at 9.16.0; 96888’s older preview range starts at 9.16.8-S1, while 97313 starts at 9.11.3-S1.
ISC lists fixes 9.20.30, 9.21.27 or 9.20.30-S1 using the supported branch/migration path. These are upstream releases, not verified Azure Linux RPM or AKS image targets. ISC lists no complete workaround and knows of no active exploits; none of these four appears in the checked CISA KEV catalog. No federal deadline or blanket rotation requirement applies.
MSP action: inventory actual package/backport, loaded named process, DNS role, recursion ACLs and GSS-TSIG/RPZ/redirect configuration → restrict unnecessary DNS and management access as a tested precaution, preserving required clients and updates → obtain a supported Azure Linux fix/backport or vendor-supported migration; rebuild affected images and restart services → verify running package/process, positive and negative DNS tests, dynamic updates, redundancy and monitoring. Restrictions reduce exposure but do not establish a complete fix.
Last verified October 30, 2026. Microsoft has not supplied complete affected RPM bounds or a fixed-package matrix. Retain that gap when recording remediation.
Official sources: Microsoft CVRF · ISC CVE-2026-94300 · ISC CVE-2026-19630 · ISC CVE-2026-96888 · ISC CVE-2026-97313 · CISA KEV