“A fix would ship, a bypass would be found, and another fix would go out,” Terra Security’s researchers wrote — and their data show 2026 is the year that pattern broke out of the shadows and into the open.
Terra Security’s review of CVEs and GitHub advisories
AI-assisted vulnerability discovery and exploitation coincided with a sharp uptick in failed fixes, according to Terra Security. The researchers reviewed every published CVE record and every GitHub-reviewed advisory and found a distinct change in 2026 after six years of relative stability. Between 2019 and 2025, the share of GitHub security fixes that required a follow-up advisory reporting a failed patch within 90 days remained at about 0.2 percent. In 2026 that figure jumped to 2.3 percent.
Terra summarized the dynamic plainly: fixes are being bypassed quickly — often before defenders can claim a problem resolved. That, the researchers say, should prompt a rethink of habit: patch and move on is no longer sufficient.
CVE-2026-21510 and CVE-2026-32202: rapid bypasses in Windows fixes
The pattern is not hypothetical. Terra highlighted a real-world example in Microsoft’s Windows stack. Russian government cyberspies exploited a zero-day Windows Shell security bypass, CVE-2026-21510, at least a month before Microsoft issued a patch in February. Microsoft’s update proved incomplete, leaving a second, zero-click authentication coercion vulnerability — CVE-2026-32202 — that was found and abused before Microsoft fixed it in April. The sequence underscores Terra’s observation that a vendor’s initial patch can be only the opening move in an exploit chain.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragePrototype-pollution and server-side request forgery: patching by reject-list
Not all bug classes are equally likely to produce broken fixes. Terra’s analysis showed that prototype-pollution vulnerabilities were about 11 times as common among broken-fix CVEs as they are among all CVEs for the same vendors; server-side request forgery (SSRF) was 4.6 times as common. The researchers attribute this to the way those bugs are commonly fixed: maintainers apply reject-lists of inputs such as hostnames, paths, and object keys.
“If the blocklist doesn't foresee every encoding of a bad input, the attacker only needs to find one,” Terra wrote. In short: blacklist-style mitigations leave a single unexpected encoding as an avenue for bypass.
Linux kernel fixes that create new CVEs
The problem also appears in low-level code. Kernel CNA records as of October 8 show that 3.2 percent of kernel CVEs were introduced by the fix for another CVE. In busier subsystems the number is higher: about 10 percent in fs/smb and net/sched, the records indicate. The kernel data reinforce Terra’s broader point: a patch can be a vector that creates new vulnerabilities if it is not written and reviewed with the whole fault surface in mind.
What this means for software vendors, sysadmins, and CISA
- Software vendors: Terra urges vendors to stop treating patches as one-off deliveries and to ask three concrete questions before shipping — does the change fix the root cause, does it cover the whole bug class, and does it break something else? The researchers frame this as a basic checklist to avoid producing bypassable fixes.
- Sysadmins and patch managers: Terra recommends applying the same scrutiny before deploying updates. “If a vendor fixes an exploited bug, assume someone is reading the patch for a way around it,” the pen testers advise — a call to validate fixes, not just install them.
- CISA and network defenders: Terra found that vulnerabilities whose fixes were later bypassed were about four times as likely to appear on the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities list as other bugs affecting the same vendors. That correlation ties broken fixes to real exploitation risk and suggests defenders should monitor for follow-up advisories as aggressively as they monitor initial patches.
Terra frames the rise in broken fixes as a wake-up call: patching remains necessary, but it is now the start of a competitive back-and-forth with attackers who are using modern tools to find one missing encoding, one overlooked edge case, one new pathway around a reject-list. Vendors, operators, and defenders who treat a shipped patch as the end point are increasingly likely to be surprised.
