The Cybersecurity and Infrastructure Security Agency has warned that a vulnerability in Flow Neuroscience FL-100 devices could allow an attacker within Bluetooth range to alter brain stimulation parameters and override safety limits. CISA identified the issue as CVE-2026-18164 in an industrial control systems medical advisory published Aug. 13, 2026.
The vulnerability is caused by an undocumented hard-coded credential shared by all device units. According to the advisory, that credential is authorized to bypass authentication. An attacker within Bluetooth range could use the weakness to manipulate stimulation parameters and the device’s state.
CISA’s advisory records the vulnerability at 8.1 under the Common Vulnerability Scoring System version 3.1, with a high-severity designation. The agency also assigns the flaw a 7.2 high-severity score under CVSS version 4.0. The CVSS 3.1 vector identifies adjacent network access, low attack complexity, no privileges required and no user interaction as the relevant attack conditions. It also reflects potential impacts to the device’s integrity and availability, while listing no confidentiality impact.
The advisory lists Flow Neuroscience FL-100 as a known-affected product. Its affected-products information also includes Halo Neuroscience FL-100. The notice identifies the Healthcare and Public Health sector as a critical infrastructure sector in which the product is deployed and lists deployment worldwide. It identifies Sweden as the location of Flow Neuroscience’s headquarters.
CISA states that the vulnerability is not exploitable remotely. An attacker would need to be within Bluetooth range of an affected device, rather than reaching it through the internet or a distant network. The advisory’s description of the flaw focuses on the hard-coded credential and its ability to bypass authentication, allowing changes to brain stimulation parameters and device state.
The potential consequences described by CISA involve the operation of the device’s stimulation functions and safety controls. Successful exploitation could allow an attacker to manipulate those settings and override safety limits. The advisory does not report known public exploitation specifically targeting CVE-2026-18164 at the time of publication.
Users are encouraged to install the latest firmware updates provided by Flow Neuroscience through the Flow app. CISA also recommends defensive measures intended to reduce the exposure of control-system devices and remote devices. Those measures include minimizing network exposure, ensuring that such devices are not accessible from the internet, placing control-system networks and remote devices behind firewalls, and isolating them from business networks.
When remote access is required, CISA recommends more secure methods such as virtual private networks. The agency says VPNs should be updated to the most current version available and cautions that a VPN is only as secure as the devices connected to it. CISA also advises organizations to conduct an impact analysis and risk assessment before deploying defensive measures.
The agency encourages organizations to implement cybersecurity strategies for proactive defense of industrial control system assets. It directs organizations that observe suspected malicious activity to follow established internal procedures and report findings to CISA for tracking and correlation with other incidents. The vulnerability was reported to CISA by A.C. Buglione.
CISA’s advisory also points users to its industrial control systems security guidance and related defensive practices. The agency recommends that users avoid clicking links or opening attachments in unsolicited email messages as part of its broader guidance on social engineering and phishing attacks.
The full advisory is available from CISA.