Full Report
Terra finds sharp rise in GitHub security fixes reported broken within 90 days
Analysis Summary
# Vulnerability: Rising Rate of Broken Security Fixes (Patch Bypass Trend, 2026)
**Note:** The article describes a trend across many advisories rather than one vulnerability. The fields below cover the specific CVEs it names, and "Not stated" marks details the article does not provide.
## CVE Details
- CVE ID: CVE-2026-21510 (Windows Shell security bypass); CVE-2026-32202 (zero-click authentication coercion, the follow-on flaw left by the incomplete patch)
- CVSS Score: Not stated in article
- CWE: Not stated in article. Bug classes named in the article map to CWE-1321 (prototype pollution) and CWE-918 (server-side request forgery).
## Affected Systems
- Products: Microsoft Windows (Windows Shell, per CVE-2026-21510 and CVE-2026-32202). The article also cites Linux kernel CVEs (fs/smb and net/sched subsystems) and GitHub-reviewed advisories across the broader ecosystem.
- Versions: Not stated in article
- Configurations: Not stated in article
## Vulnerability Description
The article reports that security fixes are increasingly being bypassed after release. Terra Security reviewed published CVE records and GitHub-reviewed advisories and found:
- The share of GitHub security fixes needing a follow-up advisory for a failed patch within 90 days stayed near 0.2% from 2019 to 2025, then rose to 2.3% in 2026.
- Fixes for bypassed vulnerabilities were about four times as likely to appear on CISA's Known Exploited Vulnerabilities (KEV) list as other bugs from the same vendors.
- Prototype-pollution fixes were about 11 times as common among broken-fix CVEs, and SSRF fixes about 4.6 times as common, relative to their share of all CVEs. The researchers attribute this to reject-list (blocklist) fixes that miss alternative encodings of malicious input.
- About 3.2% of kernel CVEs were introduced by the fix for another CVE, rising to about 10% in busy subsystems like fs/smb and net/sched.
The Windows example: Microsoft's February 2026 patch for CVE-2026-21510 was incomplete and left CVE-2026-32202, which Microsoft fixed in April.
## Exploitation
- Status: Exploited in the wild for CVE-2026-21510, attributed to Russian government cyberspies (per the article, which says the bug was exploited before the February patch). Status of CVE-2026-32202 not stated. Terra's KEV analysis indicates broken-fix vulnerabilities are more likely to be exploited in general.
- Complexity: Not stated in article
- Attack Vector: CVE-2026-32202 is described as zero-click; the vector is not otherwise specified. Remaining vectors not stated.
- PoC availability: Not stated in article
## Impact
- Confidentiality: Not stated in article
- Integrity: Not stated in article
- Availability: Not stated in article
## Remediation
### Patches
- CVE-2026-21510: Microsoft patch, February 2026 (incomplete; see bypass below)
- CVE-2026-32202: Microsoft fix, April 2026
- Exact KB or build numbers not stated in article
### Workarounds
- None specified in article.
- Guidance from the article: before applying a fix, ask whether it addresses the root cause, covers the whole bug class, and avoids breaking other functionality. Vendors should ask the same questions before shipping.
- For bug classes fixed with blocklists (SSRF, prototype pollution), prefer allowlists and canonicalized input handling. This is a general recommendation, not from the article.
## Detection
- Indicators of compromise: Not stated in article
- Detection methods and tools: Not stated in article. Practical steps include tracking vendor advisories for follow-up or "incomplete fix" notices after an initial patch, and reviewing KEV-listed vendor CVEs for related bypasses.
## References
- Terra Security research (source of the trend data): hxxps://www[.]terra[.]security/blog/how-security-patches-became-maps-for-attackers
- The Register article (source of this summary): Jessica Lyons, "Security patches need patches now that attackers have AI," 19 Oct 2026
- CISA Known Exploited Vulnerabilities catalog: referenced in the article; URL not provided