LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

A security flaw in the server behind GE Revolution CT scanners

MedDevice Cyber Staff · May 11 · 2 min read · Via Radiology Business

GE HealthCare recalled certain Revolution CT systems, the Apex, Ascend and CT lines, over a vulnerability in the AW Server deployed through the Edison Health Link CT Smart Subscription. About 200 systems worldwide, an FDA Class 2 recall, no breaches reported. Customers can keep using the systems while following cybersecurity best practices, which matters because a CT scanner is not a device a hospital takes offline to wait for a fix.

The affected piece is the connected-services layer, the AW Server reached through a cloud subscription. Every service you bolt onto a device to make it smarter is a new thing to secure. The subscription that ships analytics also ships a network path into the imaging chain.

Remediation Desk

GE HealthCare recalled certain Revolution CT systems over a flaw in the AW Server delivered through Edison Health Link, about 200 systems worldwide with no breaches reported. Apply the corrective action GE provides and confirm the AW Server component is on the remediated version.

Follow the recall correction. Apply GE HealthCare's field correction for the affected Revolution CT and AW Server configuration.
Confirm the server component version. The flaw was in the server behind the scanner, so verify that piece specifically, not just the console.
Segment imaging servers. Keep subscription-delivered server components on a controlled segment so a server-side flaw is not reachable broadly.

Sources

Radiology Business ↗

Questions & Answers

Why were GE Revolution CT systems recalled?

A vulnerability in the AW Server deployed through the Edison Health Link CT Smart Subscription, affecting about 200 systems worldwide across the Apex, Ascend and CT lines. FDA classified it Class 2, and no breaches were reported.

Can hospitals keep using the affected CT scanners?

Yes, while following cybersecurity best practices. The affected piece is the connected services layer rather than the scanner itself, and every subscription service bolted onto a device is a new network path to secure.

← Back to Vulnerabilities