What this roundup covers
Medical device cybersecurity moves fast. The FDA publishes new premarket and postmarket expectations, vulnerabilities are disclosed by CISA and ICS-CERT, and manufacturers learn the hard way through 510(k) holds and warning letters. This page consolidates what changed recently across four buckets: FDA and global regulatory updates, vulnerability disclosures, industry news, and analysis from the Blue Goat Cyber team.
For the day-by-day view, see today's medical device cybersecurity news in the Goat Feed.
For deeper coverage of any single topic, follow the linked pages. For a full timeline of regulatory action, see the Regulatory Tracker.
Medical device cybersecurity news to watch in 2026
Three stories drive most of this year's medical device cybersecurity news. First, the FDA issued its final premarket cybersecurity guidance on February 3, 2026, superseding the 2023 and 2025 versions. Our FDA cybersecurity guidance explainer breaks down what it requires. Second, eSTAR moved to version 7.1, the current template, which keeps all cybersecurity documents in a single attachment area (see our eSTAR 7.1 submission checklist). Third, CISA keeps adding exploited vulnerabilities that touch hospital networks and device components, which feeds straight into postmarket obligations under Section 524B.
If you only follow one thread, follow the guidance. Most FDA cybersecurity deficiency letters trace back to a gap between what the guidance asks for and what the submission shows.
The Goat's Weekly: this week's brief
Every Monday, the Goat's Weekly sums up the medical device security news that changed something for manufacturers in the last seven days, with what to do about it.
This week's FDA medical device news: recalls, adverse events and advisories
Pulled daily from FDA device recall and MAUDE adverse event records and CISA medical device advisories. Each entry links to the official record and our short summary.
- FDA MAUDE report•
MAUDE adverse event: CAREFUSION 303, INC. - BD Pyxis¿ ES Server
Reported to the FDA Sep 29, 2026 (event Sep 2, 2026). The FDA publishes these reports weeks after receipt. D.4 & H.4: Serial Number, Unique Device Identifier, and Manufacturer Date not available.Upon investigation of the actual device used in this incident, it was determined that the fa
Official record - FDA MAUDE report•
Unconfirmed hacking claim in FDA report: Philips Medical Systems Nederland B.V. - IntelliSpace Cardiovascular
Reported to the FDA Sep 25, 2026 (event Jan 20, 2025). The FDA publishes these reports weeks after receipt. A user alleged hacking; the report contains no confirmed cybersecurity finding.
Official record - FDA MAUDE report•
MAUDE adverse event: Beckman Coulter, Inc - ACCESS 2 IMMUNOASSAY ANALYZER
Reported to the FDA Sep 22, 2026 (event Dec 6, 2024). The FDA publishes these reports weeks after receipt. The customer reported receiving unexpectedly high Access hsTnI (Part Number B52699) patient results on an Access 2 Analyzer (serial number (b)(6)). No adverse patient impact, injur
Official record - FDA MAUDE report•
Unconfirmed hacking claim in FDA report: Medtronic Puerto Rico Operations Co. - MiniMed 780G US System BLE Connect 3.0 mg/dL
Reported to the FDA Sep 8, 2026 (event Aug 26, 2026). The FDA publishes these reports weeks after receipt. A user alleged hacking; the report contains no confirmed cybersecurity finding.
Official record - FDA MAUDE report•
Unconfirmed hacking claim in FDA report: MEDTRONIC MINIMED - CARELINK PERSONAL MMT-7333
Reported to the FDA Sep 8, 2026 (event Apr 7, 2026). The FDA publishes these reports weeks after receipt. A user alleged hacking; the report contains no confirmed cybersecurity finding.
Official record - CISA medical advisory•
Pulsetto Vagus Nerve Stimulator (Update A)
Successful exploitation of this vulnerability could allow an attacker to use could use undocumented commands to modify certain stimulation settings.
Official record - FDA recall•
FDA Recall: Nihon Kohden America LLC, Monitor, Physiological, Patient(With Arrhythmia Detection Or Alarms)
Due to a cybersecurity issue associate with a NULL Pointer Dereferences vulnerabiity. If exploited would potentially cause disruption of the centralized monitoring of multiple beds and the visualization of alarms.
Official record - FDA MAUDE report•
Unconfirmed hacking claim in FDA report: Varian Medical Systems Imaging Laboratory GmbH - ARIA Radiation Therapy Management
Reported to the FDA Aug 24, 2026. The FDA publishes these reports weeks after receipt. A user alleged hacking; the report contains no confirmed cybersecurity finding.
Official record - FDA MAUDE report•
Unconfirmed hacking claim in FDA report: Medtronic Puerto Rico Operations Co. - MiniMed 780G US System BLE Connect 3.0 mg/dL
Reported to the FDA Aug 19, 2026. The FDA publishes these reports weeks after receipt. A user alleged hacking; the report contains no confirmed cybersecurity finding.
Official record - FDA MAUDE report•
MAUDE adverse event: MEDTRONIC PUERTO RICO OPERATIONS CO. - InterStim X
Information was received from a patient who was implanted with an implantable neurostimulator (INS) for urinary/bowel dysfunction. It was reported that since they started having bronchitis in (b)(6) of this year, their therapy wouldn't let them go past 1.3 mA. The patient attempt
Official record - FDA MAUDE report•
MAUDE adverse event: ARC-ONE SOLUTIONS, LLC - Regulated Software Application (RSA), Version 2.0
NA. ARC-One Solutions received information regarding Regulated Software Application (RSA), Version 2.0 (BK200512). Specifically, an issue related to importing blood products into RSA 2.0 from a blood center's own facility, and the ability to ship these products to customers for
Official record - FDA MAUDE report•
MAUDE adverse event: Medtronic, Inc. - Medtronic IPG
It was reported by the patient that they received a letter from Medtronic indicating that there was a personal data breach. The Impl antable Pulse Generator (IPG) remains in use. No patient complications have been reported as a result of this event. Correction: B5 Medtronic subm
Official record
FDA guidance and global regulatory changes
- EU Commission••Scheduled•Impact: High
EU Cyber Resilience Act becomes fully applicable
The CRA's core obligations - secure-by-design, SBOM, vulnerability handling, and 24-hour incident reporting - apply to products with digital elements placed on the EU market. Devices regulated under the MDR or IVDR are excluded.
Read the regulatory update - Red Hat••Scheduled•Impact: High
RHEL 7 Extended Life Support ends: legacy fleets need a memo
RHEL 7 ELS reaches end of support on 30 June 2026. Devices that still ship or service with RHEL 7 need a compensating-controls memo in their postmarket file.
Read the regulatory update - CISA••Active•Impact: High
CISA adds Linux netfilter flaw to KEV (CVE-2026-0511)
A use-after-free in Linux kernel netfilter (CVE-2026-0511) was added to the Known Exploited Vulnerabilities catalog, affecting many embedded Linux device platforms.
Read the regulatory update - CISA••Active•Impact: High
CISA adds widely embedded BLE pairing bypass to the KEV
CISA added a BLE pairing bypass affecting an embedded Bluetooth stack used across consumer and medical wearables to the Known Exploited Vulnerabilities catalog.
Read the regulatory update - AAMI••Draft•Impact: Medium
ANSI/AAMI SW96 Amendment 1 draft circulated for member review
Draft amendment clarifies threat modeling traceability, security risk evaluation, and the relationship between SW96 and AAMI TIR57.
Read the regulatory update - FDA••Active•Impact: High
FDA finalizes 2026 premarket cybersecurity guidance
FDA's 2026 final guidance replaces the 2023 document and sets binding expectations for SBOM, VEX, threat modeling, security testing, postmarket plans, and CVD for every cyber device submission.
Read the regulatory update - FDA••Withdrawn•Impact: Medium
FDA 2023 premarket cybersecurity guidance superseded
The September 2023 premarket cybersecurity guidance is superseded by the February 3, 2026 final guidance. Citing the 2023 document in new submissions is now a stale reference.
Read the regulatory update - FDA••Active•Impact: High
FDA Quality Management System Regulation (QMSR) takes effect
The QMSR formally aligns 21 CFR Part 820 with ISO 13485:2016. Cybersecurity design controls, risk management, and supplier controls must now be documented under the harmonized framework.
Read the regulatory update
From Blue Goat Cyber
Blue Goat Cyber Brings Global Medical Device Cybersecurity Expertise to SWITCH Singapore 2025
Blue Goat Cyber, the global authority in medical device cybersecurity and regulatory compliance, will attend the Singapore Week of Innovation and…
Read the full updateBlue Goat Cyber Celebrates Milestone with the Release of Its 10th Episode on the Med Device Cyber Podcast
Blue Goat Cyber, a leader in medical device cybersecurity, is thrilled to announce the release of the 10th episode of the Med Device Cyber Podcast-a…
Read the full updateBlue Goat Cyber Expands Global Presence with Strategic Success at LSI Europe 2024 and RAPS Convergence 2024
Scottsdale, Arizona, United States - October 5, 2024 Blue Goat Cyber, a leader in medical device cybersecurity solutions, is excited to announce its…
Read the full updateBlue Goat Cyber Expands into Asian Market at Mednovation MedTech Forum
SCOTTSDALE, AZ, UNITED STATES, October 24, 2024 Blue Goat Cyber, a leader in medical device cybersecurity, is excited to announce its participation in the…
Read the full updateBlue Goat Cyber Highlights Expertise at DeviceTalks West 2024; Christian Espinosa Shares Key Cybersecurity Insights
SANTA CLARA, CA, UNITED STATES, October 18, 2024 Blue Goat Cyber, a leader in cybersecurity solutions for the medical device industry, showcased its…
Read the full updateBlue Goat Cyber Joins MedTech World Bay Area as Gold Sponsor; Christian Espinosa to Join Regulatory Strategy Panel
Blue Goat Cyber, a leading cybersecurity consultancy for FDA-regulated medical devices, has been announced as a Gold Sponsor of MedTech World Bay Area…
Read the full update
Press coverage & expert commentary
- Facebook•Mention
What is Traditional versus Medical Device Cybersecurity ... - Facebook
- X•Mention
Accelerating your medical device to market? FDA cybersecurity ...
- Youtube•Mention
Medical Device Cybersecurity: Entry Points & Patient Safety - YouTube
- Linkedin•Mention
Christian Espinosa's Post - LinkedIn
- Youtube•Mention
Blue Goat Cyber: Medical Device Cybersecurity Showcase - YouTube
- Linkedin•Mention
From Air Force to MedTech Cybersecurity: My Journey with Blue ...
- Youtube•Mention
How Blue Goat Cyber Helps Innovators Win FDA Approval - YouTube
- Instagram•Mention
I often see MedTech companies come to Blue Goat Cyber with only ...