Blue Goat CyberBlue Goat CyberSMMedical Device Cybersecurity

    Daily MedTech cybersecurity feed

    Today's medical device cybersecurity news: CISA KEV adds, FDA letters, breaches, guidance updates, and 524B moves curated by Blue Goat Cyber.

    criticalKEVBlue Goat Risk Score 9.0Infra · likely in-scope

    CISA KEV: OpenBSD OpenSSH CVE-2026-123158 (CVSS 3.1 8.1 HIGH) - OpenSSH Unexpected Status Code or Return Value Vulnerability

    sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of whether a string is intended to be a password hash). For some configurations of accounts, any password between 256 and 1024 characters succeeds. An example of a platform using musl libc without PAM is Alpine Linux.

    CK
    SourceCISA Known Exploited Vulnerabilities
    Read full alert
    notableMAUDE

    MAUDE adverse event: Beckman Coulter, Inc - UNICEL DXI 800 ACCESS IMMUNO ANALY

    Reported to the FDA Oct 29, 2026 (event Feb 13, 2025). The FDA publishes these reports weeks after receipt. The customer reported a Sample Presentation Unit (SPU) motion error on a UniCel DxI 800 Access Immunoassay Analyzer, Product Number 973100, Serial Number (b)(6). As reported, patie

    OM
    SourceopenFDA MAUDE
    Read full alert
    notableMAUDE

    MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Oct 28, 2026 (event Jun 23, 2026). The FDA publishes these reports weeks after receipt. Philips identified a software defect internally in Intellispace Cardiovascular (ISCV) wherein when a user logs out of the application, the authenticated session token remains valid

    OM
    SourceopenFDA MAUDE
    philipsRead full alert
    notableMAUDE

    MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Oct 28, 2026 (event Jul 1, 2026). The FDA publishes these reports weeks after receipt. Philips identified a software defect internally in Intellispace Cardiovascular (ISCV) wherein the system does not require a second step of verification (multi-factor authentication

    OM
    SourceopenFDA MAUDE
    philipsRead full alert
    notableMAUDE

    MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Oct 28, 2026 (event Jul 1, 2026). The FDA publishes these reports weeks after receipt. Philips identified a software defect internally in Intellispace Cardiovascular (ISCV) wherein the ISCV is shipped with unsigned binaries, installers, and scripts. The device was ou

    OM
    SourceopenFDA MAUDE
    philipsRead full alert
    notableMAUDE

    MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Oct 28, 2026 (event Jul 1, 2026). The FDA publishes these reports weeks after receipt. Philips identified a software defect internally in Intellispace Cardiovascular (ISCV) wherein in trusted domain mode, if two users from different trusted domains share the same use

    OM
    SourceopenFDA MAUDE
    philipsRead full alert
    notableMAUDE

    MAUDE adverse event: Unknown manufacturer - Dexcom G7 Mobile Application

    Reported to the FDA Oct 26, 2026 (event Oct 12, 2026). The FDA publishes these reports weeks after receipt. I am a type 1 diabetic and rely heavily on the Dexcom G7 Continuous Glucose Monitor\in my disease management. I have used the Dexcom G7 for about 2 weeks, but have\used other Dexco

    OM
    SourceopenFDA MAUDE
    Read full alert
    notableMAUDE

    MAUDE adverse event: Abbott Diabetes Care Ltd - Lingo App

    Reported to the FDA Oct 23, 2026 (event Sep 16, 2026). The FDA publishes these reports weeks after receipt. A third-party reported to Abbott Diabetes Care (ADC) of a cybersecurity vulnerability with the Lingo application. The cybersecurity vulnerability was identified to affect communica

    OM
    SourceopenFDA MAUDE
    abbottRead full alert
    notableMAUDE

    MAUDE adverse event: Abbott Diabetes Care Ltd - Libre App

    Reported to the FDA Oct 23, 2026 (event Sep 16, 2026). The FDA publishes these reports weeks after receipt. A third-party reported to Abbott Diabetes Care (ADC) of a cybersecurity vulnerability with the Libre Application. The cybersecurity vulnerability was identified to affect communica

    OM
    SourceopenFDA MAUDE
    abbottRead full alert
    notableMAUDE

    MAUDE adverse event: Abbott Diabetes Care Ltd - FreeStyle Libre 3 Application

    Reported to the FDA Oct 23, 2026 (event Sep 16, 2026). The FDA publishes these reports weeks after receipt. A third-party reported to Abbott Diabetes Care (ADC) of a cybersecurity vulnerability with the FreeStyle Libre 3 application. The cybersecurity vulnerability was identified to affe

    OM
    SourceopenFDA MAUDE
    abbottRead full alert
    notableMAUDE

    MAUDE adverse event: CAREFUSION 303, INC. - BD Pyxis¿ Anesthesia Station ES

    Reported to the FDA Oct 16, 2026 (event Sep 17, 2026). The FDA publishes these reports weeks after receipt. A review of the complaint history for SN (b)(6)was performed in Salesforce which did not locate similar complaint(s) with the same failure mode for this serial number.\\A review of

    OM
    SourceopenFDA MAUDE
    bdRead full alert
    notableMAUDE

    MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Oct 16, 2026 (event Jun 23, 2026). The FDA publishes these reports weeks after receipt. Philips identified a software defect internally in IntelliSpace Cardiovascular (ISCV) whereby the thick client application does not adequately distinguish between legitimate and ma

    OM
    SourceopenFDA MAUDE
    philipsRead full alert
    notableMAUDE

    MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Oct 16, 2026 (event Jul 1, 2026). The FDA publishes these reports weeks after receipt. Philips identified a software defect internally in IntelliSpace Cardiovascular (ISCV) wherein the application uses an outdated version of ASP.NET in the Service Tool, which may exp

    OM
    SourceopenFDA MAUDE
    philipsRead full alert
    notableMAUDE

    MAUDE adverse event: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular

    Reported to the FDA Oct 16, 2026 (event Jul 1, 2026). The FDA publishes these reports weeks after receipt. Philips identified a software defect internally in IntelliSpace Cardiovascular (ISCV) whereby ISCV users could browse image repository folders and navigate to patient folders conta

    OM
    SourceopenFDA MAUDE
    philipsRead full alert
    notableMAUDE

    MAUDE adverse event: CAREFUSION 303, INC. - BD Pyxis¿ MedStation¿ ES

    Reported to the FDA Oct 16, 2026 (event May 15, 2026). The FDA publishes these reports weeks after receipt. D4 & H4: Serial number, Catalog, Model, Unique Device Identifier and Manufacturer Date not available.\\A device evaluation is anticipated but has not yet begun. Upon completion of

    OM
    SourceopenFDA MAUDE
    bdRead full alert
    notableMAUDE

    MAUDE adverse event: EDAN Instruments, Inc. - Fetal & Maternal Monitor

    Reported to the FDA Oct 7, 2026. The FDA publishes these reports weeks after receipt. EDAN has identified a cybersecurity vulnerability that could allow an attacker to gain access privileges by placing a host on the same broadcast domain as the device. The vulnerabi

    OM
    SourceopenFDA MAUDE
    Read full alert
    notableMAUDE

    MAUDE adverse event: EDAN Instruments, Inc. - Vital Signs Monitor

    Reported to the FDA Oct 7, 2026. The FDA publishes these reports weeks after receipt. EDAN has identified a cybersecurity vulnerability that could allow an attacker to gain access privileges by placing a host on the same broadcast domain as the device. The vulnerabi

    OM
    SourceopenFDA MAUDE
    Read full alert
    notableMAUDE

    MAUDE adverse event: EDAN Instruments, Inc. - Fetal & Maternal Monitor

    Reported to the FDA Oct 7, 2026. The FDA publishes these reports weeks after receipt. EDAN has identified a cybersecurity vulnerability that could allow an attacker to gain access privileges by placing a host on the same broadcast domain as the device. The vulnerabi

    OM
    SourceopenFDA MAUDE
    Read full alert
    notableMAUDE

    MAUDE adverse event: EDAN Instruments, Inc. - Vital Signs Monitor

    Reported to the FDA Oct 7, 2026. The FDA publishes these reports weeks after receipt. EDAN has identified a cybersecurity vulnerability that could allow an attacker to gain access privileges by placing a host on the same broadcast domain as the device. The vulnerabi

    OM
    SourceopenFDA MAUDE
    Read full alert
    notableMAUDE

    MAUDE adverse event: EDAN Instruments, Inc. - Fetal Monitor

    Reported to the FDA Oct 7, 2026. The FDA publishes these reports weeks after receipt. EDAN has identified a cybersecurity vulnerability that could allow an attacker to gain access privileges by placing a host on the same broadcast domain as the device. The vulnerabi

    OM
    SourceopenFDA MAUDE
    Read full alert
    notableMAUDE

    MAUDE adverse event: Acclaro Corporation - UltraClear

    Reported to the FDA Sep 30, 2026 (event Aug 12, 2026). The FDA publishes these reports weeks after receipt. On (b)(6) 2026 the patient received UltraClear treatment. According to the patient impact form completed by the clinic, the treating physician immediately noticed that there was a

    OM
    SourceopenFDA MAUDE
    Read full alert
    notableMAUDE

    MAUDE adverse event: MEDTRONIC PUERTO RICO OPERATIONS CO. - INTELLIS

    Reported to the FDA Sep 25, 2026. The FDA publishes these reports weeks after receipt. Information was received from a patient (pt) regarding an implantable neurostimulator (INS). The reason for call was Pt stated that they had a couple MRIs done of their lower back

    OM
    SourceopenFDA MAUDE
    medtronicRead full alert
    notableMAUDE

    MAUDE adverse event: Abbott Diabetes Care Inc - FreeStyle Libre 3 Plus

    Reported to the FDA Sep 11, 2026 (event Aug 15, 2026). The FDA publishes these reports weeks after receipt. Sensor (b)(6)has been returned and investigated. Visual inspection performed on the returned sensor patch and no issue was observed. Data was extracted using approved software and

    OM
    SourceopenFDA MAUDE
    abbottRead full alert
    infoFDA

    FDA Recall: Illumina, Inc., High Throughput Dna Sequence Analyzer

    (Retrospectively reported) Cybersecurity vulnerability identified in communication protocol between the customer-provided infrastructure (network storage, servers, or computers) and in vitro diagnostic devices which may result in compromised data transmission.

    infoFDA

    FDA Recall: Illumina, Inc., High Throughput Dna Sequence Analyzer

    (Retrospectively reported) Cybersecurity vulnerability identified in communication protocol between the customer-provided infrastructure (network storage, servers, or computers) and in vitro diagnostic devices which may result in compromised data transmission.

    infoFDA

    FDA Recall: Illumina, Inc., High Throughput Dna Sequence Analyzer

    (Retrospectively reported) Cybersecurity vulnerability identified in communication protocol between the customer-provided infrastructure (network storage, servers, or computers) and in vitro diagnostic devices which may result in compromised data transmission.

    infoFDA

    FDA Recall: Illumina, Inc., High Throughput Dna Sequence Analyzer

    (Retrospectively reported) Cybersecurity vulnerability identified in communication protocol between the customer-provided infrastructure (network storage, servers, or computers) and in vitro diagnostic devices which may result in compromised data transmission.

    infoFDA

    FDA Recall: Illumina, Inc., High Throughput Dna Sequence Analyzer

    (Retrospectively reported) Cybersecurity vulnerability identified in communication protocol between the customer-provided infrastructure (network storage, servers, or computers) and in vitro diagnostic devices which may result in compromised data transmission.