The U.S. Cybersecurity and Infrastructure Security Agency warned that a vulnerability in Flow Neuroscience FL-100 devices could let an attacker within Bluetooth range alter brain stimulation parameters and override safety limits. CISA published the advisory on August 13, 2026, identifying the issue as CVE-2026-18164 and rating it high severity. The advisory places the affected technology in the Healthcare and Public Health sector and says the products are deployed worldwide. CISA’s advisory identifies Flow Neuroscience FL-100 as a known-affected product.
The flaw involves an undocumented hard-coded credential shared by all device units. CISA says the credential is authorized to bypass authentication, allowing an attacker in Bluetooth range to manipulate stimulation parameters and device state arbitrarily. The advisory classifies the weakness as CWE-798, or the use of hard-coded credentials.
The vulnerability is not remotely exploitable over the internet, CISA said. An attacker must be close enough to communicate with the device through Bluetooth, and the advisory’s CVSS 3.1 score reflects that local proximity requirement. The issue received a base score of 8.1, with a high-severity rating, under the vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H.
CISA also lists a CVSS 4.0 base score of 7.2, rated high severity. That assessment records high potential impact on the integrity and availability of the device while assigning no confidentiality impact. The ratings indicate that exploitation does not require prior privileges or user interaction, but does require access through an adjacent network connection, such as Bluetooth.
The advisory names Flow Neuroscience FL-100 as an affected product and also lists Halo Neuroscience FL-100 in its affected-version information. It identifies Flow Neuroscience as the vendor and gives Sweden as the company’s headquarters location. The notice does not describe a successful attack against a particular patient, organization, or device.
CISA credited A.C. Buglione with reporting the vulnerability. The agency said that no known public exploitation specifically targeting CVE-2026-18164 had been reported to it at the time of publication. That statement concerns publicly known targeting, while the technical description explains how an attacker with Bluetooth proximity could bypass authentication and change device behavior.
Users are encouraged to install the latest firmware updates provided by Flow Neuroscience through the Flow app. CISA’s mitigation guidance also calls for minimizing network exposure for control-system devices, placing remote devices behind firewalls, and isolating control-system networks from business networks. Where remote access is necessary, the agency recommends more secure methods such as updated virtual private networks, while noting that VPN security also depends on the connected devices.
CISA advises organizations to conduct an impact analysis and risk assessment before deploying defensive measures. It directs organizations that observe suspected malicious activity to follow established internal procedures and report findings to CISA for tracking and correlation. The agency also points users to its control-systems security guidance and warns against opening unsolicited email links or attachments as part of its broader social-engineering precautions.