Incomplete security patches rose about eightfold in 2026
Original title: Incomplete security patches show hackers where to look next
KEV fixes were later reported broken about four times as often as other fixes from the same vendors.
Terra Security’s Oren Yomtov reviewed published CVEs and GitHub-reviewed advisories for fixes later called incomplete or bypassable. Broken open-source fixes on GitHub stayed uncommon for years, then their share rose about eightfold in 2026. Fixes for bugs on CISA’s Known Exploited Vulnerabilities catalog were later reported broken about four times as often. Blocklist-style fixes for SSRF and prototype pollution appeared far more often among broken fixes.
Unconfirmed: The eightfold rise is Terra Security’s reading of GitHub-reviewed advisories; the later Roundcube CVE ids are not named.
- Roundcube’s March 2026 SSRF fix, CVE-2026-35540, needed three more CVEs through August.
- APT28 exploited Windows Shell bug CVE-2026-21510; Microsoft patched it in February 2026.
- Akamai’s bypass became CVE-2026-32202 in April and was also added to CISA’s exploited list.
- A crafted Control Panel item made Windows leak the user’s NTLM hash.
Impact: Bypassed Windows patch leaked a user’s NTLM hash
| Product | Affected |
|---|---|
| Roundcube | — |
| Microsoft Windows Shell | — |
- 1.Review a fix for the root cause and the whole bug class before shipping.
- 2.Keep testing exploited bugs after patching even if a scanner reports no problems.
- Vendors
- Microsoft
- Products
- RoundcubeWindows Shell
- Threat actors
- APT28
- Organizations
- Terra SecurityCISAAkamai
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-21510 | Security Feature Bypass in Microsoft Windows Shell Actively Exploited (CVE-2026-21510) | 8.8 | 25% | KEV | KEV |
| CVE-2026-32202 | Spoofing Flaw in Windows Shell (CVE-2026-32202) Actively Exploited | 4.3 | 5% | KEV | KEV |
| CVE-2026-35540 | An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14 | 6.5 | <1% |
From the original article
2 min read at helpnetsecurity.com
Security patches are turning into roadmaps for attackers, with a growing share of fixes later found incomplete or open to bypass. Oren Yomtov, a security researcher at Terra Security, began tracking broken fixes after the team kept running into them in its own work over the past year. “A fix would ship, a bypass would be found, and another fix would go out.
By Sinisa Markovic · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.