First fixes are written fast, against the exploit that was reported. Shellshock's original patch was incorrect and needed a second CVE. Log4j saw two more CVEs within a week of Log4Shell. CISA noted that Microsoft's first PrintNightmare related update did not cover public exploits using the same name. Expect follow-ups after any big disclosure.
Three documented examples
Shellshock, 2014. The CVE record for CVE-2014-6271 states the original patch was incorrect and the vulnerability remained, so CVE-2014-7169 was assigned for the leftover problem.
Log4Shell, 2021. CISA's advisory describes CVE-2021-44228 on 10 December, CVE-2021-45046 on 13 December and CVE-2021-45105 on 16 December. Version 2.15.0, the first fix for the original issue, was itself in the affected range for the second CVE.
PrintNightmare, 2021. CISA's alert says Microsoft's earlier update for CVE-2021-1675 did not address the public exploits that shared the PrintNightmare name, and later updates pointed to additional mitigations.
Why this keeps happening
- Pressure. Teams ship the smallest change that stops the known exploit, because customers are exposed right now.
- Variants. The same flaw often has more than one trigger path. Fixing one leaves siblings.
- Fresh attention. A famous bug draws researchers, who find what the first reviewers missed.
- Naming confusion. When two related issues share a nickname, people think one patch covers both.
None of this means maintainers failed. It means the first release is a checkpoint, not the finish.
A process that survives follow-ups
- Subscribe to the source. Follow the project's or vendor's security page, not only news coverage.
- Check identifiers, not nicknames. Record the CVE numbers you have addressed. A nickname hides which ones.
- Upgrade to the latest fixed release. If a newer fix exists on the day you patch, use it.
- Keep the ticket open for a few days. Review again after the first week.
- Re-scan. An automated scan flags a version that later falls into a new advisory.
- Use mitigations as a bridge. Disabling a service, such as the Print Spooler on systems that do not print, or removing a class, as in the Log4j workaround, reduces risk while you wait. CISA treats such workarounds as temporary.
What to tell stakeholders
Say it before it happens: "We will patch now, and we expect a possible second round." That keeps a follow-up CVE from looking like a failure of your team. Record each round with a date and version so an auditor or customer can follow the thread.
Click through it at your own pace, or open it full screen.
Safeguard's continuous dependency scanning re-checks your SBOMs when advisories change. Related reading: Log4j's three CVEs in a week and Shellshock explained.
Quick check
Is a follow-up CVE a sign the first fix was sloppy?
Not necessarily. Related paths are often found after a flaw gets wide attention.
Should I wait for the second fix before patching?
No. Patch now, apply mitigations where useful, and plan to review again.
Sources
Last reviewed: 19 October 2026.
