The Cybersecurity and Infrastructure Security Agency warned that a vulnerability in Flow Neuroscience FL-100 devices could allow an attacker within Bluetooth range to change brain-stimulation parameters and override safety limits. CISA published the advisory on Aug. 13, 2026, identifying the issue as CVE-2026-18164 and rating it high severity under the Common Vulnerability Scoring System, or CVSS. (CISA advisory)

The flaw involves an undocumented hard-coded credential shared by all device units. According to CISA, the credential is authorized to bypass authentication. An attacker who is close enough to communicate with a device over Bluetooth could use it to arbitrarily manipulate stimulation parameters and the device’s state.

CISA classifies the weakness as CWE-798, the use of hard-coded credentials. Because the same credential is shared across device units, authentication can be bypassed without obtaining an individual device user’s password or other credentials. The advisory identifies Flow Neuroscience FL-100 as a known-affected product.

The vulnerability is not exploitable remotely over the internet. An attacker would need to be within Bluetooth range of the device, but CISA’s scoring indicates that the attack does not require privileges or user interaction once the attacker has that proximity. The advisory lists the attack vector as adjacent, meaning the attack depends on access to the local wireless environment rather than an internet connection.

CISA’s CVSS 3.1 base score is 8.1, rated high. Its scoring vector indicates no confidentiality impact, but high potential impacts to integrity and availability. Those ratings reflect the possibility of unauthorized changes to stimulation settings and device state, as well as disruption to the device’s operation. Under CVSS 4.0, CISA assigns the vulnerability a base score of 7.2, also rated high.

The advisory places the affected product in the Healthcare and Public Health critical-infrastructure sector and says the product is deployed worldwide. The listing identifies Flow Neuroscience’s headquarters as being in Sweden. CISA did not report known public exploitation specifically targeting the vulnerability at the time of publication.

Users are encouraged to install the latest firmware updates provided by Flow Neuroscience through the Flow app. Updating the firmware is the mitigation identified in the advisory for users of the affected product.

CISA also recommends broader defensive measures for organizations that operate control-system devices or related remote equipment. The agency advises minimizing network exposure and ensuring that control-system devices and systems are not accessible from the internet. It recommends placing control-system networks and remote devices behind firewalls and isolating them from business networks.

When remote access is required, CISA recommends using more secure methods such as virtual private networks, or VPNs. The agency advises keeping VPNs updated and notes that a VPN is only as secure as the devices connected to it. CISA also tells organizations to conduct appropriate impact analysis and risk assessments before deploying defensive measures.

Organizations that observe suspected malicious activity should follow their established internal procedures and report findings to CISA for tracking and correlation with other incidents. The advisory also points users to CISA’s industrial-control-systems security guidance and related cyber-defense practices.

A.C. Buglione reported the vulnerability to CISA. The agency’s advisory was issued as an initial publication on Aug. 13, 2026.