A security analyst is reviewing the latest vulnerability scan report for a web server following an incident. The vulnerability report showed no concerning findings. The vulnerability that was used to exploit the server is present in historical vulnerability scan reports, and a patch is available for the vulnerability. Which of the following is the MOST likely cause?

A. Security patches failed to install due to a version incompatibility.

B. An adversary altered the vulnerability scan reports.

C. A zero-day vulnerability was used to exploit the web server.

D. The scan resulted in a false negative for the vulnerability.