Medical Device Cybersecurity News: Week of June 22, 2026

This is the first edition of The Goat's Weekly, our Monday digest of the medical device cybersecurity items that actually changed something for manufacturers in the last seven days. Every item below is sourced from our Regulatory Tracker, CISA's KEV catalog, and the FDA's Safety Communications archive. The summaries are short on purpose. The value is in the "what to do this week" section at the end, where we translate each item into a concrete action for a manufacturer's security lead. If you want the raw firehose, the tracker RSS feed updates as items publish.

Why this week matters

Two recent KEV additions touch components that sit inside many connected devices, and that is exactly the situation the FDA's postmarket framework was written for. Section 524B(b)(1) requires a plan to monitor, identify and address postmarket vulnerabilities, and the FDA's 2016 postmarket guidance explains how to decide whether the resulting patient risk is controlled or uncontrolled. CISA's KEV deadlines under Binding Operational Directive 22-01 bind federal civilian agencies, not manufacturers, but in our experience hospital procurement teams ask manufacturers the same questions soon after a listing. Add the AAMI SW96 amendment in review and legacy RHEL 7 fleets, and the week is about having answers ready before customers ask.

Top story: the FDA's postmarket response clock

There is no FDA program of weekly "update letters." The real expectations are in the law and in published guidance. Section 524B(b) requires cyber device makers to have a postmarket vulnerability plan that includes coordinated vulnerability disclosure, to release updates and patches on a reasonable schedule (and sooner for critical vulnerabilities that could cause uncontrolled risks), and to provide an SBOM. The FDA's 2016 guidance, Postmarket Management of Cybersecurity in Medical Devices, adds the clock: for an uncontrolled risk, notify customers within 30 days of learning about it and remediate, or put compensating controls in place, within 60 days. Doing so while participating in an ISAO can exempt the fix from Part 806 reporting. The February 3, 2026 premarket cybersecurity guidance also asks PMA holders to include cybersecurity information in their annual reports. Our advice: size your postmarket staffing to those clocks, not to a guess about FDA mail volume.

FDA and US regulatory

• Section 524B postmarket requirements. Covered above. Source: Regulatory Tracker entry.
• QMSR effective date reminder (Feb 2). The Quality Management System Regulation has been in force since February 2, 2026. Any cybersecurity activity that still lives in a parallel binder, outside design controls and supplier management, is now a documented QMS gap. Source: Regulatory Tracker entry.

CISA and vulnerability watch

• CVE-2026-0511 (Linux kernel netfilter, use-after-free) added to KEV April 22. Affects any device on a Linux base older than 6.8.12. Federal civilian agencies must remediate or remove from service per BOD 22-01. In our experience, hospitals ask for the equivalent statement from manufacturers. Source: Regulatory Tracker entry.
• BLE pairing bypass added to KEV April 15. Embedded in numerous wearable, infusion, and home-monitoring devices. If your device uses BLE Just Works pairing without out-of-band verification, this needs a VEX statement or a firmware mitigation. Source: Regulatory Tracker entry.

Standards and international

• AAMI SW96 Amendment 1 draft circulated for member review (Mar 31). Member comment window closes April 30. The amendment tightens how residual risk is justified on each risk row and adds explicit traceability columns. Worth reviewing now, even if you do not plan to comment, because the changes will appear in 2027 submissions. Source: Regulatory Tracker entry.

• RHEL 7 is past standard maintenance. Without paid Extended Life Cycle Support, a field device on RHEL 7 gets no vendor patches. If you cannot migrate, we recommend a written memo to customers explaining the compensating controls. Source: Regulatory Tracker entry.

What to do this week

1. Run your SBOM against CVE-2026-0511 and the BLE pairing bypass. If either component is present, draft a one-page VEX statement and a customer-facing memo before a hospital security office requests one. Use our SBOM and VEX field guide as the template.
2. Test your plan against the 30-day and 60-day clocks. Walk one KEV item through your Section 524B postmarket plan and confirm who notifies customers and who ships the fix.
3. Confirm none of your cleared or in-development devices ship on RHEL 7. If any do, confirm extended support coverage and schedule the migration memo.

How Blue Goat Cyber helps

We run postmarket cybersecurity programs for medical device manufacturers under our postmarket SBOM and VEX monitoring service. That includes the weekly SBOM-to-KEV diff, the customer-facing VEX statements, and a documented response package for each affected product. Our team holds CISSP and OSCP certifications and includes former military red team operators. If the FDA raises cybersecurity deficiencies after our submission, we resolve them at no additional cost.

Talk to a postmarket cybersecurity specialist

Frequently asked questions

What is the best source for medical device cybersecurity news?

What does the FDA expect when a vulnerability is found in a cleared device?

Does a CISA KEV addition require manufacturer action?

When does the AAMI SW96 Amendment 1 comment window close?

What happens to medical devices still running RHEL 7?

About the author

Christian Espinosa is the founder of Blue Goat Cyber and a former US Air Force cybersecurity officer with CISSP and CCISO credentials. He has led medical device cybersecurity submissions and postmarket programs for more than a decade and authored "The Smartest Person in the Room." More from Christian.