CISA has disclosed a high-severity vulnerability in Flow Neuroscience FL-100 devices that could let an attacker within Bluetooth range alter brain-stimulation settings and override safety limits. The advisory identifies the issue as CVE-2026-18164 and says the affected product is known to be vulnerable. CISA published the advisory on Aug. 13, 2026. CISA
The flaw stems from an undocumented hard-coded credential shared across all device units. The credential is authorized to bypass authentication, allowing an attacker in Bluetooth range to manipulate the device’s stimulation parameters and state. The vulnerability is categorized as a use of hard-coded credentials, or CWE-798.
CISA assigns the issue a CVSS version 3.1 base score of 8.1, rated high. The score reflects the need for an attacker to be within the device’s Bluetooth range, but it also indicates that no privileges or user interaction are required once that proximity condition is met. The listed impacts are on integrity and availability rather than confidentiality, consistent with the ability to change device behavior without exposing information.
The vulnerability is not remotely exploitable, CISA said. An attacker would need to communicate with the device over Bluetooth rather than reach it through the internet or another remote network connection. The advisory does not report known public exploitation specifically targeting CVE-2026-18164 at the time of publication.
CISA lists Flow Neuroscience FL-100 as the affected product. The advisory’s product information also references Flow Neuroscience and Halo Neuroscience. It places the device in the Healthcare and Public Health critical-infrastructure sector and lists deployment as worldwide. The company headquarters location is identified as Sweden.
Users are encouraged to install the latest firmware updates provided by Flow Neuroscience through the Flow app. The advisory directs users to obtain the newest update available through that channel. Keeping the device firmware current is the specific mitigation CISA identifies for the vulnerability.
The advisory credits A.C. Buglione with reporting the issue to CISA. It does not describe a known exploitation campaign or identify an attacker. The absence of reported public targeting does not change the technical risk described in the notice, particularly for devices that can be reached over Bluetooth.
For organizations managing affected devices, CISA recommends minimizing network exposure for control-system devices and related systems and ensuring they are not accessible from the internet. The agency also advises placing remote devices and control-system networks behind firewalls and isolating them from business networks.
Where remote access is necessary, CISA recommends more secure methods such as virtual private networks, while warning that VPNs can have vulnerabilities and should be updated. The agency also notes that a VPN is only as secure as the devices connected to it. Organizations are advised to conduct an impact analysis and risk assessment before applying defensive measures.
CISA encourages organizations to follow established internal procedures and report suspected malicious activity for tracking and correlation. The agency also directs users to its control-systems security guidance and other cybersecurity best-practice resources. For FL-100 users, the immediate action in the advisory is to apply the latest firmware available through the Flow app and limit unnecessary exposure to connected systems.