On this page
In this issue
FDA & US regulatory
Letters, guidance, enforcement
CISA KEV & CVEs
Vulnerabilities in your SBOM
Standards & international
AAMI, ISO, IEC, EU MDCG
What to do this week
Concrete actions for security leads
Key Takeaways
- CISA added a Linux kernel netfilter vulnerability (CVE-2026-0511) to the KEV catalog, impacting embedded systems.
- A widely used Bluetooth Low Energy (BLE) pairing bypass is now on the KEV, moving the needle from monitoring to active remediation.
- Section 524B(b)(1) requires a plan to monitor, identify and address postmarket vulnerabilities, including coordinated vulnerability disclosure (CVD).
- A new draft amendment for ANSI/AAMI SW96 aims to tighten the traceability between threat models and design controls.
The recent addition of multiple embedded vulnerabilities to the CISA Known Exploited Vulnerabilities catalog signals a shift in federal oversight for medical device manufacturers. Section 524B of the FD&C Act and the FDA's 2016 postmarket cybersecurity guidance already tell manufacturers what to do when a known exploited flaw lands in a fielded device: assess it, tell customers, and fix it on a defined clock.
While this week has been relatively quiet, the last 90 days have seen significant movements in both regulatory expectations and technical requirements. Manufacturers must navigate new entries in the Known Exploited Vulnerabilities (KEV) catalog and emerging standards from AAMI that clarify how security risk management should be documented and traced.
This recap summarizes the most critical developments from the past quarter to help security and regulatory leads ensure their compliance posture remains current.
In this brief
- Why This Matters
- Linux Kernel Netfilter Vulnerability Added to KEV
- Embedded BLE Pairing Bypass Triggers Regulatory Action
- AAMI SW96 Amendment Clarifies Traceability Requirements
- What the FDA Actually Expects After Clearance
- What to do this week
- How Blue Goat Cyber Helps
- FAQ
Why This Matters
For medical device manufacturers, a KEV listing is worth acting on even though CISA's deadlines formally apply only to federal agencies. We treat it as a practical list of known risks that deserve prompt attention, and hospital procurement teams increasingly do the same. Section 524B requires an SBOM in premarket submissions, and the FDA's February 3, 2026 premarket cybersecurity guidance expects it to be kept accurate as part of vulnerability management, so an out-of-date SBOM is worth fixing now.
Linux Kernel Netfilter Vulnerability Added to KEV
On April 22, 2026, CISA added a use-after-free vulnerability in the Linux kernel netfilter (CVE-2026-0511) to the KEV catalog.
Embedded BLE Pairing Bypass Triggers Regulatory Action
CISA also added a Bluetooth Low Energy (BLE) pairing bypass to the KEV on April 15, 2026.
AAMI SW96 Amendment Clarifies Traceability Requirements
In late March, a draft for ANSI/AAMI SW96 Amendment 1 was circulated for member review.
What the FDA Actually Expects After Clearance
Postmarket cybersecurity duties come from two real sources.
Read source: fda.gov ↗How Blue Goat Cyber Helps
Blue Goat Cyber provides specialized cybersecurity services for medical device manufacturers, including penetration testing and regulatory strategy. Our team works with you to bridge the gap between technical security findings and FDA compliance requirements. To learn more about how we can support your premarket or postmarket efforts, visit our services page.
FAQ
Get the next issue
To stay informed on the latest medical device security trends, subscribe at Goat's Weekly.