CISA adds widely embedded BLE pairing bypass to the KEV

What changed

• KEV listing triggers federal remediation SLAs and shifts FDA postmarket expectations from 'monitor' to 'act.'
• Devices using the affected stack should expect questions in any open Q-sub or postmarket update letter.

Action for manufacturers

Run an SBOM query for the affected component, issue a VEX statement (affected / not_affected / fixed / under_investigation), and document the rationale in your postmarket file.

Primary sources

• CISA Known Exploited Vulnerabilities catalog

Related Blue Goat Cyber resources

• SBOM vulnerability management for medical devices
• VEX document for medical device FDA submissions