The Cybersecurity and Infrastructure Security Agency has warned that vulnerabilities in Quanovate Tech’s Mira Hormone Monitor and Mira Android App could let attackers access reproductive health information, alter records, disrupt monitoring, expose session tokens, and take control of user accounts. The affected versions are Mira Monitor firmware 1.7.1.47 and Mira Android App 4.5.15.4, CISA says.
The advisory assigns the group a vendor equipment vulnerabilities score of 9.8 under CVSS version 3. CISA lists healthcare and public health as the relevant critical-infrastructure sector and says the products are deployed worldwide. Quanovate Tech operates the products under the Mira and Mira Care names, with company headquarters in the United States.
The most severe cloud issue, CVE-2026-68067, affects the Mira login endpoint. CISA says the endpoint accepts any format-valid string in the password field and returns an active session token for the account associated with the supplied email address. An attacker could use an email address to control an account and access hormone records and account settings. The vulnerability carries a CVSS 3.1 score of 9.8 and is classified as weak authentication.
Another cloud vulnerability, CVE-2026-67568, concerns the distributed Android application package. CISA says the affected APK permits read and write access to reproductive health profiles from internet-connected hosts, creating the possibility of forged, deleted, or destroyed health information. That issue is rated critical, with a CVSS 3.1 score of 9.1, and is attributed to the use of hard-coded credentials.
The advisory also describes risks over Bluetooth Low Energy. In firmware version 1.7.1.47, CVE-2026-66875 could allow an unauthenticated attacker within approximately 10 to 30 meters to silently rebind a monitor to an attacker-controlled account, extract stored hormone measurements in cleartext, trigger denial of service with malformed or undocumented command opcodes, and passively track a user through a static random Bluetooth address that does not rotate. CISA rates this vulnerability high, with a CVSS 3.1 score of 8.8.
A second firmware flaw, CVE-2026-66098, allows any Bluetooth central to send an unauthenticated 0x01 write. That action can reboot the monitor into bootloader mode, potentially causing denial of service or disrupting ovulation tracking and fertility-monitoring workflows. The issue has a CVSS 3.1 score of 6.5. The Android app also has a pairing weakness, CVE-2026-67558: version 4.5.15.4 identifies a paired analyzer through a substring match on its Bluetooth advertisement name without cryptographic peripheral authentication, a MAC allowlist, or a bonded-identity check. CISA says an attacker could capture live session-token information and inject forged hormone measurements into a victim’s cloud record and clinical trend view.
The advisory lists three additional weaknesses affecting the same firmware and app versions. CVE-2026-66340 allows repeated login attempts without per-account rate limiting, per-IP throttling, or account lockout, enabling brute-force attacks. CVE-2026-64934 lets an authenticated attacker submit an arbitrary firmware-version string for the attacker’s own device, which could evade vulnerable-fleet analytics, suppress security-update prompts, and misrepresent patch-adoption metrics. CISA also identifies CVE-2026-66832 as part of the affected set, while the advisory’s summary describes the broader weakness categories as missing authentication for critical functions, spoofing-based authentication bypass, hard-coded credentials, weak authentication, excessive authentication attempts, untrusted inputs in security decisions, and sensitive data in GET query strings.
CISA directs users to update the Mira app to iOS version 3.5.18 or Android version 4.5.18. When the monitor connects through the app, firmware version 01.07.01.53 is updated through that process. The advisory says no additional action is required after applying those updates.