LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

Hidden BLE commands can switch off a vagus nerve stimulator’s safety limits

MedDevice Cyber Staff · 5 days ago · 2 min read · Via CISA ICSMA-26-223-02

CVE-2026-18844 covers undisclosed commands in the Bluetooth Low Energy interface of the Pulsetto vagus nerve stimulator. The commands carry no authentication and no encryption, the companion app never issues them, and the firmware processes them anyway whenever the device is powered on. CISA rates it 8.1 on CVSS v3.1 and 7.2 on v4, classed as CWE-912, hidden functionality. Someone in radio range can disable electrical safety mechanisms or change stimulation output settings.

Every version is affected and there is no fix. CISA says it contacted Pulsetto and got no response, so ICSMA-26-223-02 points users at a manufacturer that has not answered. A.C. Buglione reported the flaw, reserved as a CVE on August 4 and published on August 11. An unanswered disclosure turns a firmware bug that one release could close into a permanent advisory attached to the product name.

Remediation Desk

There is no patch. CVE-2026-18844 covers undocumented BLE commands the Pulsetto firmware processes with no authentication, and CISA reported no vendor response. Keep the device powered off around untrusted people and treat any safety-limit behavior as unverified until the vendor ships authenticated firmware.

Assume no fix is coming soon. CISA contacted Pulsetto and got no response, so ICSMA-26-223-02 has no remediated version to move to.
Reduce radio exposure. Power the device down in public or shared environments, since the undocumented commands work for anyone in BLE range.
Remove undocumented command handlers. If you ship firmware, audit for debug or hidden command paths and strip them from production builds; every BLE write should require authentication.

Sources

Questions & Answers

What is CVE-2026-18844 in the Pulsetto Vagus Nerve Stimulator?

A hidden functionality flaw (CWE-912) rated 8.1 on CVSS v3.1 and 7.2 on v4. The Pulsetto firmware accepts undisclosed Bluetooth Low Energy commands that carry no authentication or encryption, which an attacker in range can use to disable electrical safety mechanisms or alter stimulation output.

Is there a patch for the Pulsetto Vagus Nerve Stimulator?

No. CISA lists all versions as affected in ICSMA-26-223-02, published August 11, 2026, and says Pulsetto did not respond when contacted. Users are directed to the manufacturer for remediation guidance.

Who reported the Pulsetto vulnerability?

A.C. Buglione reported CVE-2026-18844 to CISA. The CVE was reserved on August 4, 2026 and published alongside advisory ICSMA-26-223-02 on August 11, 2026.

← Back to Vulnerabilities