What this roundup covers
Medical device cybersecurity moves fast. The FDA publishes new premarket and postmarket expectations, vulnerabilities are disclosed by CISA and ICS-CERT, and manufacturers learn the hard way through 510(k) holds and warning letters. This page consolidates what changed recently across four buckets: FDA and global regulatory updates, vulnerability disclosures, industry news, and analysis from the Blue Goat Cyber team.
For the day-by-day view, see today's medical device cybersecurity news in the Goat Feed.
For deeper coverage of any single topic, follow the linked pages. For a full timeline of regulatory action, see the Regulatory Tracker.
Medical device cybersecurity news to watch in 2026
Three stories drive most of this year's medical device cybersecurity news. First, the FDA issued its final premarket cybersecurity guidance on February 3, 2026, superseding the 2023 and 2025 versions. Our FDA cybersecurity guidance explainer breaks down what it requires. Second, eSTAR moved to version 7.1, the current template, which keeps all cybersecurity documents in a single attachment area (see our eSTAR 7.1 submission checklist). Third, CISA keeps adding exploited vulnerabilities that touch hospital networks and device components, which feeds straight into postmarket obligations under Section 524B.
If you only follow one thread, follow the guidance. Most FDA cybersecurity deficiency letters trace back to a gap between what the guidance asks for and what the submission shows.
The Goat's Weekly: this week's brief
Every Monday, the Goat's Weekly sums up the medical device security news that changed something for manufacturers in the last seven days, with what to do about it.
Latest FDA & global regulatory updates
- EU Commission••Scheduled•Impact: High
EU Cyber Resilience Act becomes fully applicable
The CRA's core obligations - secure-by-design, SBOM, vulnerability handling, and 24-hour incident reporting - apply to products with digital elements placed on the EU market.
Read the regulatory update - Red Hat••Scheduled•Impact: High
RHEL 7 Extended Life Support ends: legacy fleets need a memo
RHEL 7 ELS reaches end of support on 30 June 2026. Devices that still ship or service with RHEL 7 need a compensating-controls memo in their postmarket file.
Read the regulatory update - CISA••Active•Impact: High
CISA adds Linux netfilter flaw to KEV (CVE-2026-0511)
A use-after-free in Linux kernel netfilter (CVE-2026-0511) was added to the Known Exploited Vulnerabilities catalog, affecting many embedded Linux device platforms.
Read the regulatory update - CISA••Active•Impact: High
CISA adds widely embedded BLE pairing bypass to the KEV
CISA added a BLE pairing bypass affecting an embedded Bluetooth stack used across consumer and medical wearables to the Known Exploited Vulnerabilities catalog.
Read the regulatory update - AAMI••Draft•Impact: Medium
ANSI/AAMI SW96 Amendment 1 draft circulated for member review
Draft amendment clarifies threat modeling traceability, security risk evaluation, and the relationship between SW96 and AAMI TIR57.
Read the regulatory update - FDA••Active•Impact: High
FDA finalizes 2026 premarket cybersecurity guidance
FDA's 2026 final guidance replaces the 2023 document and sets binding expectations for SBOM, VEX, threat modeling, security testing, postmarket plans, and CVD for every cyber device submission.
Read the regulatory update - FDA••Withdrawn•Impact: Medium
FDA 2023 premarket cybersecurity guidance superseded
The September 2023 premarket cybersecurity guidance is superseded by the February 3, 2026 final guidance. Citing the 2023 document in new submissions is now a stale reference.
Read the regulatory update - FDA••Active•Impact: High
FDA Quality Management System Regulation (QMSR) takes effect
The QMSR formally aligns 21 CFR Part 820 with ISO 13485:2016. Cybersecurity design controls, risk management, and supplier controls must now be documented under the harmonized framework.
Read the regulatory update
From Blue Goat Cyber
Blue Goat Cyber Brings Global Medical Device Cybersecurity Expertise to SWITCH Singapore 2025
Blue Goat Cyber, the global authority in medical device cybersecurity and regulatory compliance, will attend the Singapore Week of Innovation and…
Read the full updateBlue Goat Cyber Celebrates Milestone with the Release of Its 10th Episode on the Med Device Cyber Podcast
Blue Goat Cyber, a leader in medical device cybersecurity, is thrilled to announce the release of the 10th episode of the Med Device Cyber Podcast-a…
Read the full updateBlue Goat Cyber Expands Global Presence with Strategic Success at LSI Europe 2024 and RAPS Convergence 2024
Scottsdale, Arizona, United States - October 5, 2024 Blue Goat Cyber, a leader in medical device cybersecurity solutions, is excited to announce its…
Read the full updateBlue Goat Cyber Expands into Asian Market at Mednovation MedTech Forum
SCOTTSDALE, AZ, UNITED STATES, October 24, 2024 Blue Goat Cyber, a leader in medical device cybersecurity, is excited to announce its participation in the…
Read the full updateBlue Goat Cyber Highlights Expertise at DeviceTalks West 2024; Christian Espinosa Shares Key Cybersecurity Insights
SANTA CLARA, CA, UNITED STATES, October 18, 2024 Blue Goat Cyber, a leader in cybersecurity solutions for the medical device industry, showcased its…
Read the full updateBlue Goat Cyber Joins MedTech World Bay Area as Gold Sponsor; Christian Espinosa to Join Regulatory Strategy Panel
Blue Goat Cyber, a leading cybersecurity consultancy for FDA-regulated medical devices, has been announced as a Gold Sponsor of MedTech World Bay Area…
Read the full update
Press coverage & expert commentary
- Facebook•Mention
What is Traditional versus Medical Device Cybersecurity ... - Facebook
- X•Mention
Accelerating your medical device to market? FDA cybersecurity ...
- Youtube•Mention
Medical Device Cybersecurity: Entry Points & Patient Safety - YouTube
- Linkedin•Mention
Christian Espinosa's Post - LinkedIn
- Youtube•Mention
Blue Goat Cyber: Medical Device Cybersecurity Showcase - YouTube
- Linkedin•Mention
From Air Force to MedTech Cybersecurity: My Journey with Blue ...
- Youtube•Mention
How Blue Goat Cyber Helps Innovators Win FDA Approval - YouTube
- Instagram•Mention
I often see MedTech companies come to Blue Goat Cyber with only ...