# Sen. Wyden Urges Binding Federal Mandate to Purge Internet-Facing Legacy VPNs for Zero-Trust Remote Access

> On 2026-07-27, Sen. Ron Wyden sent a letter (with accompanying CRS memo) to OMB, CISA, and NIST calling for a binding operational directive requiring federal civilian agencies to eliminate internet-facing legacy VPN appliances within two years and migrate to zero-trust network access (ZTNA), citing a multi-year pattern of Chinese and Russian state-sponsored actors repeatedly compromising Pulse Secure, Ivanti, VMware, F5, Cisco, Fortinet, and Check Point remote-access products. The letter also proposes FAR/DFARS procurement rules barring purchase of non-NIST-zero-trust-certified remote-access products.

- **Published:** 2026-07-27T00:00:00Z
- **Last reviewed:** 2026-07-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1774
- **ID:** TL-2026-1774
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** Russian state-sponsored APT clusters (China, Russia, Iran)
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2019-11510, CVE-2019-11539, CVE-2019-19781, CVE-2020-5902, CVE-2021-22893, CVE-2020-8243, CVE-2021-22900, CVE-2021-22894, CVE-2023-46805, CVE-2024-21887, CVE-2025-0282, CVE-2023-27997, CVE-2024-24919, CVE-2024-20353, CVE-2024-20358, CVE-2024-20359, CVE-2025-41244, CVE-2024-37079, CVE-2025-22224, CVE-2025-22225, CVE-2025-22226

## Description

Senator Ron Wyden (D-OR) sent a letter dated 2026-07-27 to OMB Federal CISO Gregory Barbaccia, CISA, and NIST, accompanied by a Congressional Research Service (CRS) memo, arguing that the federal government's reliance on internet-facing legacy VPN appliances constitutes an unfixable architectural weakness rather than a series of isolated patching failures. The letter documents that Chinese and Russian state-sponsored hacking groups have repeatedly exploited internet-facing VPN and network-edge products from Pulse Secure, VMware, Ivanti, F5, and Cisco (reporting from CyberScoop and CyberInsider additionally names Fortinet and Check Point) against federal agencies and government contractors, prompting numerous CISA emergency directives over the past several years (ED 21-03 for Pulse Connect Secure in 2021, ED 24-01 for Ivanti Connect Secure/Policy Secure in 2024, and ED 26-01 for F5 BIG-IP in 2025).

This pattern is independently corroborated by the historical exploitation record: CVE-2019-11510 (Pulse Secure pre-auth arbitrary file read) was exploited by Iranian actors (OilRig, Chafer, Shamoon) and later cited in a 2020 DOJ indictment of Chinese APT41 members for supply-chain intrusions; CVE-2023-46805/CVE-2024-21887 (Ivanti Connect Secure) triggered CISA ED 24-01 after suspected China-nexus exploitation; CVE-2025-0282 (Ivanti) was zero-day exploited from mid-December 2024 by UNC5337 (part of the broader UNC5221 cluster) deploying the SPAWN malware family; Cisco ASA/FTD firewalls were targeted since mid-2023 by the state-sponsored ArcaneDoor campaign (Cisco Talos: UAT4356; Microsoft: STORM-1849) using the custom Line Dancer and Line Runner implants; VMware Tools/vCenter/ESXi flaws (CVE-2025-41244, CVE-2024-37079, CVE-2025-22224/22225/22226) were exploited by China-nexus UNC5174; and in October 2025 F5 disclosed that a nation-state actor (linked to China-nexus UNC5221 and the BRICKSTORM backdoor) had persistent, undetected access to its BIG-IP product-development and engineering-knowledge environments for roughly 12 months, exfiltrating source code and undisclosed-vulnerability data, prompting CISA ED 26-01.

The CRS memo explains that zero-trust architectures replace these inbound-listening, internet-exposed appliances with outbound-only connections that continuously verify user/device identity and restrict access to specific applications rather than the whole network, eliminating the scannable, always-open attack surface that adversaries have exploited for over half a decade. Wyden's specific asks: (1) CISA issue a Binding Operational Directive requiring FCEB civilian agencies to eliminate legacy public-facing VPNs within two years; (2) NSA impose an equivalent deadline on military/intelligence-community networks; (3) NIST publish implementation standards mandating outbound-only zero-trust architectures, memory-safe programming languages, agency-controlled encryption keys, and alignment with post-quantum cryptography; (4) OMB draft a memo directing agency investment in zero-trust infrastructure; and (5) FAR/DFARS be updated to bar agencies and defense contractors from purchasing VPN/remote-access products unless the vendor formally attests NIST zero-trust compliance. The letter cites a Travelers Q4 2025 Cyber Threat Report finding that 85% of ransomware-related cyber-insurance claims stemmed from exploited VPNs, underscoring that the exposure is not limited to nation-state espionage but also enables ransomware access-brokering.

## MITRE ATT&CK

- T1595 Active Scanning
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1543 Create or Modify System Process
- T1136 Create Account
- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1070 Indicator Removal
- T1027 Obfuscated Files or Information
- T1620 Reflective Code Loading
- T1553 Subvert Trust Controls
- T1036 Masquerading
- T1003 OS Credential Dumping
- T1552 Unsecured Credentials
- T1110 Brute Force
- T1082 System Information Discovery
- T1018 Remote System Discovery
- T1210 Exploitation of Remote Services
- T1021 Remote Services
- T1074 Data Staged
- T1560 Archive Collected Data
- T1071 Application Layer Protocol
- T1572 Protocol Tunneling
- T1090 Proxy
- T1132 Data Encoding
- T1568 Dynamic Resolution
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact

## Sources

- [Letter to OMB, CISA, and NIST on legacy VPN replacement (Sen. Ron Wyden, with CRS memo)](https://www.wyden.senate.gov/imo/media/doc/wyden-vpn-letter-omb-cisa-nist-with-crs-memopdf.pdf)
- [Sen. Wyden urges feds to discard older, insecure, public-facing VPNs](https://cyberscoop.com/wyden-calls-for-federal-legacy-vpn-purge-zero-trust/)
- [Outdated VPNs should be purged from federal agencies, senator says](https://therecord.media/federal-purge-outdated-vpns-wyden-letter)
- [Wyden calls for federal ban on legacy VPNs over security concerns](https://cyberinsider.com/wyden-calls-for-federal-ban-on-legacy-vpns-over-security-concerns/)
- [Wyden urges federal agencies to replace legacy VPNs with zero-trust architectures to counter nation-state cyber threats](https://industrialcyber.co/zero-trust/wyden-urges-federal-agencies-to-replace-legacy-vpns-with-zero-trust-architectures-to-counter-nation-state-cyber-threats/)
- [Wyden Demands Two-Year Federal VPN Purge: Zero-Trust Procurement Rule Would Reshape Vendor Market](https://www.techtimes.com/articles/321768/20260728/wyden-demands-two-year-federal-vpn-purge-zero-trust-procurement-rule-would-reshape-vendor-market.htm)
- [ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities](https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities)
- [ED 21-03: Mitigate Pulse Connect Secure Product Vulnerabilities (Closed)](https://www.cisa.gov/news-events/directives/ed-21-03-mitigate-pulse-connect-secure-product-vulnerabilities-closed)
- [Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways (AA24-060B)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060b)
- [ArcaneDoor - New espionage-focused campaign found targeting perimeter network devices](https://blog.talosintelligence.com/arcanedoor-new-espionage-focused-campaign-found-targeting-perimeter-network-devices/)
- [CISA issues emergency directive after F5 discloses nation-state breach](https://www.scworld.com/news/cisa-issues-emergency-directive-after-f5-discloses-nation-state-breach)
- [F5 Breach Exposes BIG-IP Source Code — Nation-State Hackers Behind Massive Intrusion](https://thehackernews.com/2025/10/f5-breach-exposes-big-ip-source-code.html)
- [PRC State-Sponsored Actors Use BRICKSTORM Malware Across Public Sector and Information Technology Systems](https://www.cisa.gov/news-events/alerts/2025/12/04/prc-state-sponsored-actors-use-brickstorm-malware-across-public-sector-and-information-technology)
- [PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a)
- [CVE-2025-0282: Ivanti Connect Secure Zero-Day Vulnerability Exploited In The Wild](https://www.tenable.com/blog/cve-2025-0282-ivanti-connect-secure-zero-day-vulnerability-exploited-in-the-wild)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1774