The Cybersecurity and Infrastructure Security Agency has issued a high-severity advisory for a vulnerability in Flow Neuroscience’s FL-100 that could allow an attacker within Bluetooth range to manipulate brain stimulation parameters and override safety limits. The advisory identifies the issue as CVE-2026-18164 and lists the affected product as known affected. CISA published the advisory Aug. 13, 2026.
The flaw involves an undocumented hard-coded credential shared by all device units. CISA said the credential is authorized to bypass authentication, allowing an attacker within Bluetooth range to arbitrarily manipulate the device’s brain stimulation parameters and state. The weakness is categorized as CWE-798, which covers the use of hard-coded credentials.
CISA assigned the vulnerability a CVSS version 3.1 base score of 8.1, placing it in the high-severity category. The score describes an attack that can be carried out through an adjacent connection, with low complexity, no privileges required and no user interaction required. The scoring identifies potential effects on integrity and availability, while confidentiality is not affected.
Under CVSS version 4.0, CISA assigned the vulnerability a base score of 7.2, also rated high. That score likewise identifies an adjacent attack path that requires no privileges or user interaction. The advisory lists the affected product under Flow Neuroscience FL-100 and includes Flow Neuroscience as the vendor. It identifies the company’s headquarters as being in Sweden and says the product is deployed worldwide.
CISA said the vulnerability is not exploitable remotely. The agency also said no known public exploitation specifically targeting the vulnerability had been reported at the time of the advisory. The documented attack path requires an attacker to be within Bluetooth range of an affected unit.
The agency is encouraging users to install the latest firmware updates provided by Flow Neuroscience through the Flow app. CISA’s mitigation guidance advises organizations to take defensive measures to minimize the risk of exploitation and to conduct an impact analysis and risk assessment before deploying them.
CISA also recommends minimizing network exposure for control-system devices and systems and ensuring they are not accessible from the internet. Control-system networks and remote devices should be placed behind firewalls and isolated from business networks, according to the agency’s recommended practices.
When remote access is required, CISA recommends using more secure methods such as virtual private networks. The agency cautions that VPNs can have vulnerabilities and should be updated to the most current version available. It also notes that a VPN is only as secure as the devices connected to it.
The advisory places the issue within CISA’s guidance for control-system cybersecurity. The agency encourages organizations to implement proactive cybersecurity strategies and refers users to additional guidance on defense-in-depth strategies and targeted cyber intrusion detection and mitigation.
Organizations that observe suspected malicious activity should follow their established internal procedures and report findings to CISA for tracking and correlation with other incidents. The advisory also repeats CISA guidance on social engineering, including avoiding links and attachments in unsolicited email messages.
CISA’s advisory is available at CISA’s ICS medical advisory.