IC Oversight & Policy — 2026-07-28

Senator Wyden Urges CISA OMB and NIST to Purge Legacy VPNs From Federal Networks

BLUFWyden's letter applies useful oversight pressure, but CISA is very unlikely within 90 days to issue a binding directive of this scope absent White House backing or a catalyzing breach.

Sen. Ron Wyden (D-OR) sent a letter Monday to OMB, CISA, and NIST calling on the agencies to lead a purge of legacy, public-facing VPNs from federal networks in favor of zero-trust remote-access architecture 123. Wyden cited recent intrusions exploiting Cisco (ArcaneDoor), Fortinet (FortiBleed), Ivanti, and Check Point VPN appliances as evidence that internet-facing remote-access gateways function as an exposed front door for attackers 14. He proposed CISA issue a binding operational directive giving civilian agencies two years to remove legacy public-facing remote access systems, with NSA ordering a parallel purge across military and intelligence networks, NIST publishing zero-trust implementation standards, and OMB directing agencies to prioritize zero-trust spending and tightening procurement rules with CISA and the Defense Department 124. The Record reported Russian and Chinese hackers have exploited years-old VPNs to target federal systems 2, and GovInfoSecurity cited a March VulnCheck finding that roughly 42% of vulnerabilities exploited last year affected end-of-life or near-end-of-life devices 4.

Analysis
Wyden's proposal would impose a two-year VPN migration deadline plus parallel NSA and procurement mandates, a scope exceeding any binding operational directive CISA has issued to date, and CISA is very unlikely to issue such a directive within the next 90 days absent White House or appropriations backing, since prior directives followed active exploitation rather than preemptive congressional requests and no timeline commitment has surfaced from CISA, OMB, or NIST. This judgment carries moderate confidence, resting on consistent secondary reporting of the letter's contents against the absence of any observable agency response. Convergence across outlets is high but shallow, since CyberScoop, The Record, and GovInfoSecurity all trace to the same primary Wyden letter rather than independent corroboration. The letter may function primarily as political signaling ahead of the next appropriations cycle rather than a proposal CISA intends to adopt, and without a directive agencies will keep patching legacy VPNs reactively after each new exploitation wave rather than budgeting a forced zero-trust migration.

4 sources

Sen. Wyden urges feds to discard older, insecure, public-facing VPNs - CyberScoop
Outdated VPNs should be purged from federal agencies, senator says - The Record
Letter to OMB, CISA, and NIST on Legacy VPN Purge - Office of Senator Ron Wyden
Wyden Calls for Edge Device Annihilation in US Government - GovInfoSecurity