The U.S. Cybersecurity and Infrastructure Security Agency warned Aug. 13 that a vulnerability in Flow Neuroscience FL-100 devices could let an attacker within Bluetooth range alter brain-stimulation settings and override safety limits. The advisory identifies the issue as CVE-2026-18164 and rates it high severity under CVSS version 3.1, with a base score of 8.1. CISA’s advisory says the affected product is deployed worldwide and falls within the healthcare and public health sector.
The flaw stems from an undocumented hard-coded credential shared across device units. CISA said that credential is authorized to bypass authentication, allowing a nearby attacker to manipulate stimulation parameters and the device’s operating state without valid privileges. The vulnerability is categorized as CWE-798, the weakness class covering the use of hard-coded credentials.
The affected product is listed as Flow Neuroscience FL-100, with Halo Neuroscience FL-100 also named in the advisory’s affected-product information. CISA’s record marks the product status as known affected. The advisory identifies Flow Neuroscience as the vendor and lists Sweden as the company’s headquarters location. Its CVSS 3.1 vector indicates that exploitation requires adjacent access, but no authentication or user interaction, and could have a high impact on integrity and availability. The newer CVSS 4.0 scoring gives the issue a base score of 7.2, also classified as high severity.
The exposure is limited by the need for Bluetooth proximity. CISA states that the vulnerability is not remotely exploitable, meaning an attacker cannot use it solely through an internet connection. The advisory also says no known public exploitation specifically targeting CVE-2026-18164 had been reported to the agency at the time of publication.
Users are encouraged to install the latest firmware updates provided by Flow Neuroscience through the Flow app. CISA recommends that users take defensive measures to minimize the risk of exploitation while applying the mitigation and other security practices described in the advisory.
CISA also recommends reducing network exposure for control-system devices and ensuring that they are not accessible from the internet. The agency advises placing control-system networks and remote devices behind firewalls and isolating them from business networks. Where remote access is necessary, CISA recommends using more secure methods such as virtual private networks, while warning that VPNs may have vulnerabilities and should be updated to the latest available version. The agency also notes that VPN protection depends on the security of the connected devices.
CISA reminds organizations to perform a proper impact analysis and risk assessment before deploying defensive measures. It encourages organizations to implement recommended cybersecurity strategies for proactive defense of industrial control system assets. The agency points to its control-systems security guidance on cisa.gov/ics, including materials on defense-in-depth strategies and targeted cyber-intrusion detection and mitigation.
Organizations observing suspected malicious activity are directed to follow established internal procedures and report findings to CISA for tracking and correlation with other incidents. CISA separately recommends that users avoid clicking web links or opening attachments in unsolicited email messages as a defense against social engineering and phishing attacks.
The advisory was initially published Aug. 13, 2026. A.C. Buglione was credited with reporting the vulnerability to CISA, which issued the notice under its industrial control systems and medical advisory program.