On this page
In this issue
FDA & US regulatory
Letters, guidance, enforcement
CISA KEV & CVEs
Vulnerabilities in your SBOM
Standards & international
AAMI, ISO, IEC, EU MDCG
What to do this week
Concrete actions for security leads
Key Takeaways
- Intelerad Medical Systems reported a vulnerability in radiological image processing software that could allow administrative session hijacking.
- Illumina issued multiple retrospective recalls for DNA sequence analyzers involving vulnerabilities in protocols used for infrastructure communication.
- A firmware issue in Boston Scientific neurostimulation systems has led to device non-functionality, highlighting the critical nature of firmware stability.
- CISA added a new Ivanti Connect Secure vulnerability to the Known Exploited Vulnerabilities (KEV) catalog, impacting remote maintenance pathways.
- The FDA's February 3, 2026, premarket guidance remains the active standard for security architecture and Software Bill of Materials (SBOM) documentation.
The most significant recent developments include a series of retrospective recalls for high throughput DNA sequence analyzers due to communication protocol vulnerabilities and a critical recall for radiological image processing software. These events underscore the persistent risk of unauthorized session takeover and compromised data transmission in clinical environments.
While the last week has been relatively quiet, the previous 90 days have seen a steady stream of regulatory activity regarding software integrity and communication security. Product security leads should take this time to review their postmarket monitoring plans, as required by Section 524B of the FD&C Act, ensuring that vulnerabilities in both firmware and network protocols are addressed before they lead to uncontrolled risks.
In this brief
- Intelerad Medical Systems Recall: Session Hijacking Risk
- Illumina DNA Sequence Analyzers: Retrospective Communication Recalls
- Boston Scientific Spinal Cord Stimulators: Firmware Failure
- CISA KEV Update: Ivanti Connect Secure Vulnerability
- Why This Matters
- What to do this week
- How Blue Goat Cyber Helps
- FAQ
Why This Matters
These highlights demonstrate that cybersecurity risks often extend beyond the device itself to the communication protocols and infrastructure that support them. For manufacturers, a failure in a network storage protocol or a predictable session identifier can be just as damaging as a direct exploit of the device hardware, necessitating a security posture that covers the entire data transmission lifecycle.
Intelerad Medical Systems Recall: Session Hijacking Risk
A cybersecurity vulnerability has been identified in Intelerad Medical Systems' radiological image processing software.
Illumina DNA Sequence Analyzers: Retrospective Communication Recalls
Illumina, Inc.
Boston Scientific Spinal Cord Stimulators: Firmware Failure
A firmware issue has been identified in the Therapy Disc (TD) of the Boston Scientific Neuromodulation spinal cord stimulator system.
CISA KEV Update: Ivanti Connect Secure Vulnerability
CISA has added CVE-2026-118527 to its Known Exploited Vulnerabilities (KEV) catalog.
What to do this week
- Audit all administrative session management configurations in clinical software to ensure session identifiers are not predictable.
- Verify that all external communication protocols used for network storage or server data transfers utilize encrypted and authenticated channels.
- Review your SBOM for the presence of Ivanti components or similar VPN gateways and confirm that the latest security patches are applied.
How Blue Goat Cyber Helps
Blue Goat Cyber assists medical device manufacturers in navigating the complexities of the FDA's February 3, 2026, premarket cybersecurity guidance. Our team provides expert pen testing and security architecture reviews to help you identify vulnerabilities before they result in a recall. For more information, visit our services page or contact us.
FAQ
Does the FDA require a specific SBOM update schedule?
Section 524B of the FD&C Act requires providing an SBOM but sets no specific update schedule.
What is the notification timeline for an uncontrolled cybersecurity risk?
The FDA's 2016 guidance recommends notifying customers within 30 days of learning of an uncontrolled risk.
What guidance currently governs premarket cybersecurity submissions?
The FDA's February 3, 2026, premarket cybersecurity guidance is the current active version.
Get the next issue
Subscribe to stay informed on the latest regulatory updates and cybersecurity trends at Goat's Weekly.