The Cybersecurity and Infrastructure Security Agency warned Aug. 13 that a vulnerability in Flow Neuroscience’s FL-100 could let an attacker within Bluetooth range change brain-stimulation parameters and override safety limits. The advisory identifies the issue as CVE-2026-18164 and rates it high severity under CVSS 3.1, with a base score of 8.1. CISA said the affected product is deployed worldwide in the Healthcare and Public Health sector.
The flaw involves an undocumented hard-coded credential shared across all device units. CISA said the credential is authorized to bypass authentication, allowing a nearby attacker to manipulate the device’s stimulation parameters and state without valid authorization. The agency classified the issue as CWE-798, or the use of hard-coded credentials. CISA’s advisory lists Flow Neuroscience FL-100 as a known-affected product and also identifies Halo Neuroscience FL-100 in the affected-product information.
The attack requires proximity. CISA said the vulnerability is not exploitable remotely, and its technical scoring specifies an adjacent network attack with no required privileges or user interaction. In practical terms described by the advisory, an attacker would need to be within Bluetooth range rather than reach the device over the internet. The notice does not report known public exploitation specifically targeting CVE-2026-18164.
CISA recommended that users install the latest firmware updates provided by Flow Neuroscience through the Flow app. The advisory does not identify a firmware version number or provide a separate patch deadline.
The vulnerability’s CVSS 3.1 vector gives it high impact for integrity and availability while assigning no confidentiality impact. The vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. CISA’s CVSS 4.0 score is 7.2, also rated high, with the vector CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N.
For organizations managing affected equipment, CISA advised minimizing network exposure for control-system devices and keeping them inaccessible from the public internet. The agency also recommended placing control-system networks and remote devices behind firewalls and isolating them from business networks. Where remote access is necessary, CISA said organizations should use more secure methods such as virtual private networks, while keeping in mind that a VPN’s security depends on the connected devices and the VPN itself must be updated.
CISA urged organizations to conduct an impact analysis and risk assessment before applying defensive measures. It directed organizations that observe suspected malicious activity to follow established internal procedures and report findings to the agency for tracking and correlation. The advisory was initially published Aug. 13, 2026, and lists A.C. Buglione as the person who reported the vulnerability to CISA.
The advisory also points organizations to CISA’s control-systems security guidance and related cyber defense practices. Its recommended measures include defense-in-depth strategies and additional guidance on detecting and mitigating targeted cyber intrusions. CISA separately advised users to avoid clicking links or opening attachments in unsolicited email messages as a protection against social-engineering attacks.