Vulnerabilities

CVSS

8.1 High

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Risk score

64.8

Published

2026-08-11

Status

Published

The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on.

Weaknesses

CWE-912

Coverage 1

vulnerability

Pulsetto Vagus Nerve Stimulator

A critical vulnerability (CVE-2026-18844) exists in Pulsetto Vagus Nerve Stimulator devices, allowing attackers to bypass security measures and manipulate device settings via Bluetooth Low Energy (BLE). The vulnerability…

CISA Advisories · Aug 11, 2026 Critical

CVE-2026-18844LIbluetoothcvecontrol systems

All articles mentioning it

Advisories and references

• cisa.gov/news-events/ics-medical-advisories/icsma-26-223-02
• github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-...