CVE-2026-52686

LowCVSS 3.7

Published: 23/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

Vulnerability in DNSSEC validation allows bypassing signature verification for wildcard expansion proofs (NSEC/NSEC3) when the answer is a CNAME or DNAME record.

Risk Assessment

An attacker can forge DNS responses, bypassing DNSSEC protection, leading to traffic redirection or phishing.

Recommendation

Apply the patch from the DNS software vendor. Temporarily consider disabling wildcard support in DNSSEC zones.

Original NVD description (English source)

The issue is a DNSSEC validation bypass where wildcard expansion proofs (NSEC/NSEC3 records) are accepted without signature validation when the wildcard answer is a CNAME or DNAME record.