Late Friday, three independent threat intel teams flagged in-the-wild exploitation of an unauthenticated remote code execution flaw affecting a widely deployed enterprise VPN gateway. Within 48 hours, exploitation had spread from opportunistic scanning to targeted intrusion attempts against financial services and healthcare organizations.

The vendor has released an emergency patch, but rollout across large fleets rarely happens overnight. For CISOs, the immediate priority is triage: identify exposed appliances, apply compensating network controls, and rotate any credentials that may have transited the affected service during the exposure window.

Boards will ask a simple question are we exposed, and for how long were we exposed. The honest answer requires an asset inventory that most organizations do not have at the fidelity they need. This is, again, the argument for continuous exposure management rather than annual audits.

We will keep this post updated as the vendor publishes further guidance and as indicators of compromise are confirmed by additional research teams.