Rise in broken security patches exposes EMEA finance to APT28-style bypasses

1. Executive summary

Terra Security reviewed every published CVE record and GitHub-reviewed advisory and found that the share of open-source fixes later reported incomplete or bypassable rose roughly eightfold in 2026, from a steady 0.2 percent (2019 to 2025) to 2.3 percent. Two of the examples are directly relevant to EMEA financial services. CVE-2026-21510 (CVSS 8.8 HIGH, CWE-693, in CISA KEV since 2026-02-10, EPSS 25 percent) is a Windows Shell flaw that APT28 exploited in the wild; Microsoft's February 2026 fix was bypassed by a crafted Control Panel item that coerced NTLM authentication to an attacker server, and the bypass shipped as CVE-2026-32202 (CVSS 4.3 MEDIUM, CWE-693, in CISA KEV since 2026-04-28, EPSS 5 percent). CVE-2026-35540 (CVSS 5.4 MEDIUM, CWE-669, not in CISA KEV, EPSS 0 percent) is a Roundcube SSRF whose March 2026 blocklist fix missed alternate encodings and resolving domain names, requiring three further CVEs in May, July and August. Both KEV entries are past their added dates and remain exploitable in the wild; any estate still running the pre-April Windows Shell state or a Roundcube build older than the August fix carries the bypass, not just the original bug.

2. Regulatory framing

3. Technical analysis & attack chain

The two confirmed chains below are the ones the sources describe in enough detail to act on. Terra's aggregate statistics (the eightfold rise, the fourfold KEV correlation, the 11x prototype-pollution and 4.6x SSRF over-representation) come from a single vendor's review and are not independently corroborated in the sources provided.

Windows Shell, CVE-2026-21510 to CVE-2026-32202:

1. APT28 exploited CVE-2026-21510, a Windows Shell security feature bypass, in the wild at least a month before Microsoft patched it in February 2026.
2. Microsoft's February 2026 fix for CVE-2026-21510 was incomplete.
3. Akamai found the patch could be bypassed with a crafted Control Panel item. The item caused Windows to contact an attacker-controlled server and leak the user's NTLM hash.
4. Microsoft fixed the bypass in April 2026 as CVE-2026-32202, described as a zero-click authentication coercion vulnerability. That flaw was also found and abused before the April fix and was added to CISA KEV on 2026-04-28.
5. The April advisory for CVE-2026-32202 makes no mention of CVE-2026-21510, so a patch-management record keyed only to the April CVE will not show that the February fix was superseded.

The mechanism that matters for defenders is NTLM coercion: a Control Panel item is a file the shell will process, and the crafted item makes the host initiate an outbound authentication to a server the attacker controls. The leaked NTLM hash can then be relayed or cracked offline. The sources do not state which Windows builds beyond "Windows 10 and 11 systems, as well as some Server versions" are affected for the related October Shell bypass, and do not give the exact affected build range for CVE-2026-21510 or CVE-2026-32202. Confirm against Microsoft's advisories before scoping.

Roundcube, CVE-2026-35540:

1. In March 2026 Roundcube developers fixed an SSRF flaw, CVE-2026-35540, by blocking links to private addresses.
2. The blocklist check missed other ways of writing the same address, and missed domain names that resolve to a private address.
3. Closing those gaps took three more CVEs, released in May, July and August 2026.
4. An attacker who can submit a link through the webmail interface can reach internal addresses the blocklist was meant to stop, provided the Roundcube build predates the August fix.

Terra's explanation for why these classes break is that the fix is a reject-list of inputs (hostnames, paths, object keys), and "if the blocklist doesn't foresee every encoding of a bad input, the attacker only needs to find one." The same pattern applies to prototype pollution, which Terra found about 11 times as common among broken-fix CVEs as among CVEs overall; SSRF was 4.6 times as common. Terra also reports, from kernel CNA records as of 2026-10-08, that 3.2 percent of Linux kernel CVEs were introduced by the fix for another CVE, rising to about 10 percent in busy subsystems such as fs/smb and net/sched. That figure is single-sourced.

Attribution: the sources state APT28 exploited CVE-2026-21510 in the wild. MITRE ATT&CK tracks APT28 as G0007, so the actor is a known profile, but the specific exploitation claim here rests on the reporting cited by Help Net Security and The Register, not on a vendor incident report reproduced in the sources. Treat the APT28 link to this specific exploitation as reported rather than independently confirmed by Adverse Trace.

4. Mitigation & containment

P1 within 24 hours

• Confirm the April 2026 fix for CVE-2026-32202 is deployed on every Windows 10, Windows 11 and Windows Server estate. A host patched only to the February 2026 level for CVE-2026-21510 still carries the bypass. Query your patch inventory for the April 2026 Microsoft cumulative update and treat any host below it as exposed.
• Block outbound SMB (TCP 445) and WebDAV (TCP 80/443 to internal hosts) from workstation VLANs to the internet and to untrusted internal segments. NTLM coercion depends on the host being able to reach the attacker server; egress filtering breaks the chain even on an unpatched host.
• Enable SMB signing and require LDAP signing and channel binding on domain controllers to reduce the value of a leaked NTLM hash. The sources describe the hash leak but do not name a specific relay target, so apply this as general NTLM hardening.
• Upgrade Roundcube to a build that includes the August 2026 fix. The March 2026 fix for CVE-2026-35540 is not sufficient. If you cannot confirm the build, disable the link-preview or remote-fetch feature that processes submitted URLs until you can.

P2 within 72 hours

• Hunt for Control Panel items (.cpl files) written to user-writable paths and for shell processes spawning outbound authentication. The sources do not give a filename, path or registry key for the crafted item, so hunt on behaviour: a .cpl file created outside System32 and a subsequent outbound connection from explorer.exe or rundll32.exe to an external host.
• Review proxy and firewall logs for outbound connections from workstations to unfamiliar external hosts that coincide with .cpl file creation. The sources give no indicator values, so this is behavioural hunting only.
• For Roundcube, review webmail logs for requests that reference private-range addresses or hostnames resolving to them, including alternate encodings (decimal, octal, IPv6-mapped) and redirect chains. The sources name the bypass classes but not the exact payloads.

P3 within 7 days

• Add a post-patch validation step to the patch process for any CVE on CISA KEV: after deployment, re-test the specific bypass rather than relying on a clean scanner result. Terra's advice is to "keep testing after a scanner reports no problems."
• For internally developed or forked code, diff the vendor fix against the root cause and check whether it covers the whole bug class, not just the reported input. Terra's three questions: does it fix the root cause, does it cover the whole bug class, does it break something else.
• Track the three follow-on Roundcube CVEs from May, July and August 2026 against your deployed version. The sources do not give their CVE identifiers, so obtain them from the Roundcube advisory history.

5. Indicators of compromise

No indicators of compromise available in the source material. The sources describe behaviour (a crafted Control Panel item causing NTLM hash leakage, and SSRF via alternate address encodings) but give no hashes, domains, IP addresses, file paths or registry keys.

Behavioural indicators

6. Detection

The sources give no file hashes, mutex names, command-line flags, registry keys or hard-coded strings for either flaw. The only artefacts are behavioural: .cpl file creation and outbound NTLM authentication, and SSRF requests to private addresses. A YARA rule built on those would be guessing at strings the sources do not provide, so none is emitted. The Sigma rule below targets the .cpl creation behaviour, which is the one artefact the sources describe concretely enough to express as a log condition.

title: Control Panel Item Created Outside System32
id: 7f3c2a91-4b6e-4d2a-9c1f-8e5a0b3d6c72
status: experimental
description: Detects creation of a .cpl file outside System32, consistent with the crafted Control Panel item used to bypass the CVE-2026-21510 fix (CVE-2026-32202).
author: Adverse Trace
date: 2026/10/20
references:

  - https://www.helpnetsecurity.com/2026/10/20/ncomplete-security-patches-broken-fixes-rise/
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: '.cpl'
  filter_system32:
    TargetFilename|startswith: 'C:\Windows\System32\'
  condition: selection and not filter_system32
falsepositives:

  - Legitimate third-party control panel applets installed to Program Files
level: medium

CVE assessment

3 referenced CVEs — 2 actively exploited (CISA KEV)

Threat actor context

APT28 · G0007 · aka IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit

APT28 is a threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) 85th Main Special Service Center (GTsSS) military unit 26165. This group has been active since at least 2004. …

7. Sources

• Help Net Security, "Incomplete security patches show hackers where to look next", https://www.helpnetsecurity.com/2026/10/20/ncomplete-security-patches-broken-fixes-rise/, 2026-10-20.
• The Register, "Security patches need patches now that attackers have AI", https://www.theregister.com/patches/2026/10/19/security-patches-need-patches-now-that-attackers-have-ai/5303927, 2026-10-19.
• Krebs on Security, "Microsoft Patches More Than 1,400 Security Flaws", https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/, October 2026.

8. Adverse Trace position

Adverse Trace assesses CVE-2026-21510 and CVE-2026-32202 as the priority for EMEA financial services clients because both are in CISA KEV, both are past their added dates, and the second is a bypass of the first, so a host patched only to February 2026 is still exposed. CVE-2026-35540 is lower urgency (CVSS 5.4, not in KEV, EPSS 0 percent) but the Roundcube fix history shows the March patch is not the end state, and any client running Roundcube webmail should confirm the August 2026 build. The aggregate statistics on broken fixes come from a single vendor, Terra Security, and the APT28 exploitation claim is reported rather than independently confirmed by us; we will re-check both against Microsoft and Roundcube advisories and update this note if the affected build ranges or the follow-on Roundcube CVE identifiers become available. Clients should confirm the April 2026 Windows cumulative update is deployed across all Windows 10, 11 and Server estates within 24 hours and report back on any host that cannot be confirmed.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.