BD Alaris Sets Inside Hospital Kits and an Exploited Remote Support Flaw
Cardinal Health flags Presource kits containing BD Alaris sets, while BeyondTrust confirms active exploitation of a critical Remote Support flaw.
Editorial
Two new alerts deserve priority this week. Cardinal Health reported that certain Presource kits contain BD Alaris infusion sets subject either to correction or to updated instructions for use. At the same time, BeyondTrust confirmed that a critical Remote Support vulnerability was exploited as a zero-day against both hosted and self-managed instances. The first alert requires hospitals to distinguish between products that look alike but require different actions. The second calls for reviewing a platform that may have privileged access to hospital systems. At the end of this edition, we include only the relevant changes concerning StatStrip, Philips Lumify, and ChloraPrep, which were covered last week.
[ALERT] Presource Kits Containing BD Alaris Sets: Two Different Actions Depending on the Product
BD (Becton Dickinson) and CareFusion 303 updated the actions applicable to certain infusion sets compatible with the BD Alaris 8100 Pump Module. This week, Cardinal Health reported that some Presource kits, preassembled packages prepared for a procedure, contain sets included in those communications. The FDA published two separate notices: one requires certain kits to be corrected before continued use, while the other updates the instructions for products whose performance may be worse than previously disclosed.
Alaris infusion sets are disposable components that connect the pump to the patient. They are used in intensive care, operating rooms, oncology, and other areas where medications or fluids are administered intravenously. With certain designs and under specific conditions, particularly flow rates below 1 mL/hour or bolus volumes of 5 mL or less, the sets may cause under-infusion, over-infusion, delayed occlusion alarms, or inaccurate bolus delivery.
The challenge for midsize hospitals is twofold. First, the sets may be distributed across several departments and inside kits that have already been opened. Second, hospitals that use Cardinal Health Presource kits may not associate those supplies with the original BD alert.
References:
-
BD Alaris Pump Infusion Sets Recall, updated October 5, 2026: https://www.fda.gov/medical-devices/medical-device-recalls-and-early-alerts/infusion-set-recall-bd-and-carefusion-303-inc-remove-bd-alaris-pump-infusion-sets
-
Cardinal Health Presource Packs Early Alert, October 20, 2026: https://www.fda.gov/medical-devices/medical-device-recalls-and-early-alerts/early-alert-cardinal-health-issues-correction-presource-packs-containing-bd-alaris-pump-infusion
-
Cardinal Health Updated Use Instructions, October 20, 2026: https://www.fda.gov/medical-devices/medical-device-recalls-and-early-alerts/early-alert-cardinal-health-updates-use-instructions-presource-packs-containing-bd-alaris-pump
Suggested action: Identify affected Presource kits and BD Alaris sets using the product lists supplied by Cardinal Health and BD. For kits subject to correction, quarantine them, attach the warning label, and remove and discard the identified component before using the remainder of the kit. For products subject to updated instructions, review the performance tables and adjust set selection, flow rate, bolus volume, and clinical monitoring. Do not assume that every product requires the same action: confirm the catalog number and lot with the supplier.
Any action involving active medical devices should be coordinated with clinical engineering, the manufacturer, and the hospital’s medical leadership before implementation.
[ALERT] BeyondTrust Remote Support: Critical Vulnerability Actively Exploited
This alert does not involve a medical device. It concerns a remote technical support platform that may be used to manage hospital systems. BeyondTrust Remote Support contains a critical vulnerability (CVE-2026-102764, CVSS 4.0: 9.3) that has been exploited as a zero-day since August 29, 2026.
Why does this matter to a hospital? The vulnerability allows a remote attacker to perform file operations on the affected appliance. If the platform is used to manage clinical workstations or connected systems, compromising it may provide a privileged entry point. The reach into other systems will depend on the deployment configuration and its assigned permissions. The vendor confirmed exploitation against one BeyondTrust-hosted instance and one self-managed instance.
BeyondTrust applied the correction to its SaaS customers on October 9. Remote Support 26.2.3 and earlier versions are affected. Self-managed deployments running versions 24.3.1 through 26.2.3 must apply the BT26-05-RS patch if they do not receive automatic updates. Deployments older than 24.3.1 must be upgraded first.
References:
-
BeyondTrust BT26-05: https://www.beyondtrust.com/trust-center/security-advisories/bt26-05
-
INCIBE-CERT INCIBE-2026-757: https://www.incibe.es/incibe-cert/alerta-temprana/avisos/validacion-incorrecta-del-origen-en-remote-support-de-beyondtrust
Suggested action: Confirm whether BeyondTrust Remote Support is in use and whether the instance is SaaS or self-managed. For self-managed deployments, verify the version and update status; apply BT26-05-RS immediately or upgrade first if the version is older than 24.3.1. Review logs beginning August 29 and use the vendor’s published indicators of compromise to search for anomalous activity.
Any remote support platform update should follow the hospital’s change management process and be accompanied by a review of logs and indicators of compromise.
Follow-Up on Previous Alerts
StatStrip Gen 2.0: FDA Confirms Removal
The previous edition covered Nova Biomedical’s software correction. The October 20 update is that the FDA confirmed the removal of StatStrip Gen 2.0 models 63685 and 66739 until the update becomes available; StatStrip Gen 1.86 is not included. Nova reported one serious injury and no deaths. The update is expected to roll out in phases beginning in November 2026.
**Updated action:** Remove affected Gen 2.0 meters from use. At facilities with integrated ADT data, confirm that `Validate Patient ID’s` is enabled in NovaNet while coordinating the update with the manufacturer.
Philips Lumify: Now Classified as a Class I Recall
The FDA updated Lumify’s status on October 19 and classified it as a Class I recall. Philips reported eight serious injuries and four deaths. While the software update is being developed, the device should be used only where reliable Wi-Fi or cellular service is available, unless a backup ultrasound system is immediately available.
ChloraPrep: AVID Medical and Destruction of the Entire Kit
The Medline alert covered last week is now joined by a Class I classification for certain AVID Medical kits. The current instruction for the identified products is to quarantine and destroy the entire kit after completing the response form. Removing only the applicator is no longer sufficient.
View the AVID Medical notice →
Reference Case
*No publicly documented incidents with sufficient clinical detail were identified this week for inclusion as a reference case. Coverage will resume in a future edition.*
In Brief
- Edwards Lifesciences Commander M delivery system, removal of lots 67718561, 67804014, 67887043, and 67887044, used with the SAPIEN M3 transcatheter mitral valve replacement system. The manufacturer received three reports of balloon rupture during inflation, associated with one serious injury and one death. Do not use the affected lots and coordinate their return with Edwards. (FDA Early Alert, October 15, 2026: https://www.fda.gov/medical-devices/medical-device-recalls-and-early-alerts/early-alert-transcatheter-mitral-valve-delivery-system-issue-edwards-lifesciences)
- Par Health and Endo USA Argatroban Injection, voluntary recall of 22 lots of Argatroban Injection 250 mg/2.5 mL due to particulate matter identified as cellulose, polystyrene, polyethylene terephthalate, stopper material, and possibly stainless steel. Hospital pharmacies should immediately discontinue use and distribution of affected lots and coordinate their return. (FDA, October 14, 2026: https://www.fda.gov/safety/recalls-market-withdrawals-safety-alerts/par-health-issues-voluntary-nationwide-recall-argatroban-injection-due-presence-particulate-matter)
Closing
This week’s alerts demonstrate why a hospital inventory must contain more than a manufacturer’s name. Whether an organization needs to remove a device, correct a kit, or update its instructions depends on the model, catalog number, lot, and software version. A general instruction may be insufficient or may even remove from service a product that requires a different action.
The immediate priorities are clear: separate Presource kits according to Cardinal Health’s instructions and confirm that every self-managed BeyondTrust instance has the BT26-05-RS patch installed. As follow-up actions, remove affected StatStrip Gen 2.0 meters, ensure reliable connectivity or an ultrasound backup for Lumify, and destroy the ChloraPrep kits covered by the recall. In clinical safety, identifying the exact product is the first control.
Bisturí Digital provides information for awareness and risk management purposes. It does not replace manufacturer instructions, medical leadership decisions, or the internal processes of clinical engineering, pharmacy, epidemiology, and information technology teams.