On this page
In this issue
FDA & US regulatory
Letters, guidance, enforcement
CISA KEV & CVEs
Vulnerabilities in your SBOM
Standards & international
AAMI, ISO, IEC, EU MDCG
What to do this week
Concrete actions for security leads
Key Takeaways
- CISA added CVE-2026-118527 to the KEV catalog, affecting Ivanti Connect Secure VPNs.
- The Ivanti vulnerability allows attackers to place malicious files in predictable system locations.
- CISA added CVE-2026-46300 to the KEV catalog, a high-severity flaw in the Linux Kernel.
- The Linux vulnerability involves a missing initialization of a variable in the networking stack.
- Device manufacturers using affected Linux-based TCP/IP stacks for encrypted telemetry are at high risk.
The most critical developments this week involve two new additions to the CISA Known Exploited Vulnerabilities (KEV) catalog affecting Ivanti Connect Secure and the Linux Kernel. Medical device manufacturers using Ivanti for remote access or Linux for networking must prioritize verifying their firmware and kernel versions to address active exploitation risks.
This week, the focus shifts to infrastructure and operating system vulnerabilities that directly impact medical device ecosystems. As CISA adds new entries to the KEV catalog, manufacturers are reminded that the security of their connected products often depends on the underlying third-party components and network gateways used for data transmission.
Security leads should pay close attention to vulnerabilities that allow for predictable file placement or memory corruption, as these are frequently used as building blocks for more complex cyberattacks. Maintaining an accurate Software Bill of Materials (SBOM) remains essential for identifying these risks within the device lifecycle.
In this brief
- Ivanti Connect Secure Vulnerability (CVE-2026-118527)
- Linux Kernel Memory Corruption (CVE-2026-46300)
- Why This Matters
- What to do this week
- How Blue Goat Cyber Helps
- FAQ
Why This Matters
For medical device manufacturers, these vulnerabilities represent risks to the "postmarket" phase of the device lifecycle. Under Section 524B of the FD&C Act, manufacturers must have a plan to monitor, identify, and address postmarket vulnerabilities. When a third-party component like the Linux kernel or a gateway like Ivanti is compromised, it can impact the integrity of clinical SaaS platforms or the confidentiality of patient telemetry.
Ivanti Connect Secure Vulnerability (CVE-2026-118527)
CISA has added CVE-2026-118527 to its catalog of known exploited vulnerabilities.
Linux Kernel Memory Corruption (CVE-2026-46300)
The Linux Kernel is facing a high-severity vulnerability, CVE-2026-46300, which carries a CVSS 3.1 score of 7.8.
What to do this week
- Audit your SBOM to identify any medical devices or internal infrastructure running affected versions of the Linux Kernel.
- Verify the firmware versions of any Ivanti Connect Secure instances used for remote device maintenance or clinical cloud hosting.
- Review your postmarket monitoring plan to ensure it accounts for CISA KEV updates as part of the vulnerability identification process.
How Blue Goat Cyber Helps
Blue Goat Cyber provides specialized services to help medical device manufacturers navigate the requirements of Section 524B of the FD&C Act. Our team, led by experts like Christian Espinosa, assists with penetration testing and the development of security architecture views. For more information on securing your products, visit our services page.
FAQ
Get the next issue
Stay informed on the latest regulatory updates and vulnerabilities by subscribing to Goat's Weekly.