1. Executive summary
Two Windows flaws, CVE-2026-21510 (CVSS 8.8 HIGH, CWE-693) and CVE-2026-32202 (CVSS 4.3 MEDIUM, CWE-693), were both exploited before Microsoft fixed them, and both are now in CISA KEV (added 2026-02-10 and 2026-04-28 respectively). The first was a Windows Shell security bypass exploited by actors The Register describes as Russian government cyberspies; the February patch was incomplete and left the second flaw, a zero-click authentication coercion issue, which was also abused before its April fix. Terra Security reports that the share of GitHub security fixes needing a follow-up advisory within 90 days rose from about 0.2 percent (2019 to 2025) to 2.3 percent in 2026, and that bypassed-fix CVEs are about four times as likely to reach CISA KEV as other bugs from the same vendors. For EMEA financial services the exposure is not a single unpatched host but a patching assumption: a deployed fix for an exploited bug no longer proves the bug is closed, and the two CVEs here show that gap being used before a complete fix existed.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 17 | Two exploited Windows flaws (CVE-2026-21510, CVE-2026-32202) where the first vendor fix was incomplete and a second bypass was abused before its own fix | The incident-management process has to cover a fix that fails to close the flaw, including re-detection, re-triage and re-remediation of hosts already marked patched, not just the initial patch ticket |
| DORA Art. 18 | A patch bypass is a cyber threat that recurs after remediation; Terra's data shows the pattern rising across vendors | Classification has to account for a threat that survives the first fix, so a closed patch record is not treated as a closed incident |
| NIS2 Art. 21(2)(d) | Exploitation of a Windows component flaw that reached CISA KEV, in a supply chain where the vendor's fix was itself defective | Supply chain security measures must include verifying that a vendor fix actually closes the flaw before relying on it, not only tracking that a fix shipped |
3. Technical analysis & attack chain
The confirmed sequence, from The Register's reporting of Terra Security's research:
- A zero-day Windows Shell security bypass, CVE-2026-21510, was exploited in the wild by actors described as Russian government cyberspies at least a month before Microsoft patched it in February 2026.
- Microsoft's February fix was incomplete. It left a second flaw, a zero-click authentication coercion vulnerability tracked as CVE-2026-32202.
- CVE-2026-32202 was found and abused before Microsoft fixed it in April 2026.
Both CVEs are in CISA KEV. CVE-2026-21510 carries CVSS 8.8 HIGH and EPSS 25 percent; CVE-2026-32202 carries CVSS 4.3 MEDIUM and EPSS 5 percent. Both are classified CWE-693 (protection mechanism failure). The source does not give the affected Windows versions, the exact Shell component, the coercion protocol, or the exploitation commands, so this advisory cannot specify them.
The mechanism that matters to a defender is the one Terra describes across the wider data set. Fixes for server-side request forgery and prototype-pollution bugs are the most frequently bypassed, because they are built as reject-lists of inputs such as hostnames, paths and object keys. Terra's stated reason: "If the blocklist doesn't foresee every encoding of a bad input, the attacker only needs to find one." Compared with their share of all CVEs, prototype-pollution flaws were about 11 times as common among broken-fix CVEs and SSRF flaws 4.6 times as common. The Windows flaws here are CWE-693 rather than SSRF or prototype pollution, so the reject-list mechanism is context for why bypasses recur, not a description of how CVE-2026-21510 or CVE-2026-32202 were bypassed. The source does not state the bypass technique for either CVE.
Terra's figures: the share of GitHub security fixes requiring a follow-up advisory for a failed patch within 90 days held at about 0.2 percent from 2019 to 2025 and rose to 2.3 percent in 2026. Vulnerabilities whose fixes were later bypassed were about four times as likely to appear on CISA KEV as other bugs affecting the same vendors. Separately, kernel CNA records as of 8 October show 3.2 percent of Linux kernel CVEs were introduced by the fix for another CVE, rising to about 10 percent in busy subsystems such as fs/smb and net/sched. That kernel figure is a different measurement (fixes that introduce new bugs) from the bypass figure and should not be combined with it.
Attribution caveat: the "Russian government cyberspies" attribution for the CVE-2026-21510 exploitation is single-sourced to The Register's report and has no MITRE ATT&CK profile. Treat it as unconfirmed. No tooling, infrastructure, command-and-control or exfiltration detail is given for either exploitation, and none is asserted here.
4. Mitigation & containment
P1 within 24h
- Confirm CVE-2026-21510 and CVE-2026-32202 are remediated to the April 2026 or later Windows cumulative update on every endpoint and server, and treat any host patched only to the February release as still exposed to CVE-2026-32202. Both are in CISA KEV; the source gives no KEV remediation due-date, so apply your own KEV-driven SLA.
- Hunt for post-February, pre-April activity on hosts that were patched in February, since CVE-2026-32202 was abused in that window. The source gives no atomic indicators, so scope the hunt by host patch state and the KEV listing dates rather than by IOC.
- Where EDR or application control can block Windows Shell and authentication-coercion behaviour, review whether those controls were in enforce mode across the February to April window on internet-facing and privileged-access hosts.
P2 within 72h
- Change the patch-verification step: after applying a fix for an exploited bug, verify the specific behaviour the CVE describes is actually blocked, rather than closing the ticket on install success. Terra's advice is to assume that when a vendor fixes an exploited bug, someone is reading the patch for a way around it.
- For any SSRF or prototype-pollution fix in your own or third-party code, test the reject-list against alternate encodings of the blocked hostnames, paths and object keys before signing off, given the 4.6x and 11x over-representation of these classes among broken fixes.
- Track vendor follow-up advisories for 90 days after any fix for an exploited CVE, matching Terra's 90-day measurement window, and reopen the patch record if a bypass advisory appears.
P3 within 7 days
- Add a review gate for kernel and filesystem/network-subsystem updates (fs/smb, net/sched) that checks whether the update itself introduces a regression, given the 3.2 percent and 10 percent figures.
- Require human review and testing of any AI-generated patch before it is applied to production, given the 1Password finding reported by Krebs that LLM-generated patches failed to fix the flaw or added a new weakness more than half the time. The source does not name the models or the test set.
5. Indicators of compromise
No indicators of compromise available in the source material. The sources give no hashes, domains, IP addresses, file paths, registry keys or command lines for CVE-2026-21510 or CVE-2026-32202. The only machine-actionable identifiers are the CVE IDs and their CISA KEV listing dates, which are not threat artefacts and are not reproduced as IOCs.
6. Detection
Insufficient indicators to author detection rules. The sources describe the exploitation at the level of CVE and patch timeline only, with no distinctive strings, command-line flags, file names, registry keys or network artefacts for either flaw. A rule built on the CVE identifiers or the "Windows Shell" and "authentication coercion" descriptions would detect reporting about the threat, not the threat. Detection for these two CVEs should run off patch state and the CISA KEV listing dates in §4 until vendor or incident-response telemetry supplies artefacts.
CVE assessment
2 referenced CVEs — 2 actively exploited (CISA KEV)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-21510 | 8.8 High | ⚠ KEV 2026-02-10 | 25% | Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network. |
| CVE-2026-32202 | 4.3 Medium | ⚠ KEV 2026-04-28 | 5% | Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network. |
7. Sources
- The Register, "Security patches need patches now that attackers have AI", https://www.theregister.com/patches/2026/10/19/security-patches-need-patches-now-that-attackers-have-ai/5303927, 2026-10-19.
- The Register, "AI is making Patch Tuesday (kinda) fun again", https://www.theregister.com/patches/2026/06/09/ai-is-making-patch-tuesday-kinda-fun-again/5253225, 2026-06-09.
- Securelist (Kaspersky GReAT), "Exploits and vulnerabilities in Q2 2026", https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/, Q2 2026.
- Krebs on Security, "Microsoft Patches a Record 570 Security Flaws", https://krebsonsecurity.com/2026/07/microsoft-patches-a-record-570-security-flaws/, 2026-07.
- Schneier on Security, "Microsoft's Patching", https://www.schneier.com/blog/archives/2026/09/microsofts-patching.html, 2026-09.
- Krebs on Security, "Microsoft Plugs Nearly 400 Security Holes", https://krebsonsecurity.com/2026/08/microsoft-plugs-nearly-400-security-holes/, 2026-08.
8. Adverse Trace position
Adverse Trace assesses CVE-2026-21510 as CVSS 8.8 HIGH and CVE-2026-32202 as CVSS 4.3 MEDIUM, both in CISA KEV, and treats the "Russian government cyberspies" attribution as unconfirmed because it rests on a single report and has no MITRE ATT&CK profile. The client impact is concentrated in patch assurance: the February fix for an exploited bug did not close the flaw, and the residual CVE-2026-32202 was abused before April, so any EMEA financial services firm that closed its CVE-2026-21510 ticket on the February update should reopen it and verify CVE-2026-32202 coverage now. The Terra figures are single-sourced to that vendor's review of CVE records and GitHub advisories; verify the methodology before using the 2.3 percent or 4x numbers in board reporting. We will monitor for a vendor advisory naming the affected Windows versions and the coercion protocol for CVE-2026-32202, and will reissue this note with atomic indicators if incident-response telemetry for either CVE becomes available.
Published via PulseTrace — Adverse Trace threat intelligence.