The Cybersecurity and Infrastructure Security Agency (CISA) published a Cybersecurity Advisory on August 13, 2026, regarding vulnerability CVE-2026-18164 in Flow Neuroscience devices. The advisory warns that the flaw allows unauthorized access to brain stimulation parameters through Bluetooth connections.

Vulnerability CVE-2026-18164 involves an undocumented hard-coded credential shared by all device units that is authorized to bypass authentication. This security defect affects the Flow Neuroscience FL-100 and Halo Neuroscience FL-100 with firmware versions prior to July 2026.

Successful exploitation of CVE-2026-18164 allows an attacker within Bluetooth range to manipulate brain stimulation parameters and override safety limits. The vulnerability has a CVSS v3.1 base score of 8.1 (HIGH) and a CVSS v4.0 base score of 7.2 (HIGH).

The official record states that the vulnerability CVE-2026-18164 has a CVSS 4.0 vector string of CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N. A.C. Buglione reported vulnerability CVE-2026-18164 to CISA.

CISA recommends users install the latest firmware updates provided by Flow Neuroscience via the Flow app to mitigate the vulnerability. No known public exploitation specifically targeting vulnerability CVE-2026-18164 has been reported to CISA. Flow Neuroscience is headquartered in Sweden.

What's New

A study titled "Cybersecurity vulnerability analysis of medical devices purchased by national health services" was published in 2023 in Scientific Reports. The official record states that the vulnerability CVE-2026-18164 has a CVSS 4.0 vector string of CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N.

Why It Matters

The advisory highlights a critical risk to medical device security where hardcoded credentials can bypass authentication mechanisms. Successful exploitation permits remote manipulation of brain stimulation parameters, which could override established safety limits for patients using the affected hardware.

The high severity scores assigned to this vulnerability indicate significant potential impact on integrity and availability. Users must apply firmware updates through the designated application to secure their devices against potential Bluetooth-based attacks within proximity.