The exploitation of CVE-2026-35273 calls attention to systemic failures in risk management and the need for board accountability in cybersecurity.