Key points
- The rate of GitHub fixes requiring follow-up advisories jumped from 0.2 percent to 2.3 percent in 2026.
- Prototype-pollution and server-side request forgery patches are disproportionately likely to be broken.
- Bypassed vulnerabilities are four times more likely to appear on CISA’s Known Exploited Vulnerabilities list.
Terra Security researchers have identified a significant increase in security patches that fail to fully resolve vulnerabilities. This trend complicates remediation strategies for security operations teams managing large software estates.
What happened
Terra Security analysed published CVE records and GitHub-reviewed advisories to track instances where initial security fixes were subsequently bypassed. The study covered data from 2019 through 2026, allowing for a longitudinal view of patch effectiveness.
Between 2019 and 2025, the share of GitHub security fixes that required a follow-up advisory reporting a failed patch within 90 days remained stable at approximately 0.2 percent. This baseline indicated that most patches were effective upon release.
In 2026, this figure rose sharply to 2.3 percent, according to Terra researchers. The increase coincides with a broader expansion in AI-driven vulnerability discovery and automated patching tools.
The researchers observed a distinct pattern in 2026: a fix would ship, a bypass would be found, and another fix would be issued. This cycle suggests that initial remediation efforts are increasingly incomplete.
Why it matters
Vulnerabilities whose fixes were later bypassed were about four times as likely to appear on the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities list. This indicates that broken patches often leave systems exposed to active exploitation.
Prototype-pollution vulnerabilities were about 11 times as common among broken-fix CVEs compared with their share of all CVEs. Server-side request forgery vulnerabilities were 4.6 times as common in this category. These specific flaw types require heightened scrutiny during remediation.
Microsoft Windows Shell issues illustrate the risk. CVE-2026-21510 was exploited by Russian government cyberspies before a February patch. The initial fix was incomplete, leaving a second flaw, CVE-2026-32202, which was also abused before an April fix.
What happens next
Security teams must adjust their monitoring processes to account for the possibility that initial patches may not be final. Continuous validation of remediation status is now more critical than in previous years.
Organisations should prioritise tracking follow-up advisories for high-risk vulnerability classes. Prototype-pollution and server-side request forgery issues demand particular attention due to their high rates of patch failure.
Vendors and developers need to improve the robustness of their initial fixes. The rise in AI-assisted discovery means that bypasses will be found more quickly than before.
Patch priority
Teams usually begin by identifying systems exposed to the internet or handling sensitive data. Check whether the initial patch addresses the root cause or merely mitigates symptoms. Back up configurations before applying any updates to ensure rollback capability. Test patches in a staging environment to verify they do not introduce new bypasses. Monitor vendor communications for follow-up advisories, as initial fixes may be incomplete. Reduce exposure by restricting access to vulnerable services until a comprehensive fix is confirmed.
What to do and how to stay safe: Terra Security
- Monitor vendor channels for follow-up advisories related to recently applied patches, especially for prototype-pollution and server-side request forgery issues.
- Validate that applied patches have not been bypassed by checking for secondary CVEs or updated guidance from the vendor.
- Prioritise remediation of systems listed on CISA’s Known Exploited Vulnerabilities catalogue, as these are more likely to have flawed initial fixes.
- Review internal change management processes to ensure rapid deployment of secondary patches when initial fixes are found to be incomplete.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How much did the rate of broken patches increase in 2026?
The share of GitHub security fixes requiring a follow-up advisory within 90 days jumped from 0.2 percent to 2.3 percent.
Which types of vulnerabilities are most likely to have broken fixes?
Prototype-pollution and server-side request forgery vulnerabilities are disproportionately common among broken-fix CVEs.
Are broken patches more likely to be exploited?
Yes, vulnerabilities with bypassed fixes are about four times as likely to appear on CISA’s Known Exploited Vulnerabilities list.
