A vulnerability in the Flow Neuroscience FL-100 could let an attacker within Bluetooth range alter brain stimulation parameters and override safety limits, the Cybersecurity and Infrastructure Security Agency said in an advisory published Aug. 13. The advisory lists Flow Neuroscience FL-100 and Halo Neuroscience FL-100 among the affected product names.

The flaw, tracked as CVE-2026-18164, involves an undocumented hard-coded credential shared across all device units. CISA said the credential is authorized to bypass authentication. An attacker within Bluetooth range could use it to arbitrarily manipulate stimulation parameters and the device’s state, including settings related to brain stimulation and safety limits.

The vulnerability is not remotely exploitable, according to CISA. An attacker would need to be within Bluetooth range of the device, but the advisory’s scoring reflects that no user interaction or existing privileges are required once that access is available. The listed CVSS version 3.1 base score is 8.1, rated high. Its vector gives the issue an adjacent attack vector, low attack complexity, no required privileges and no required user interaction, with high impacts to integrity and availability.

CISA also lists a CVSS 4.0 base score of 7.2, rated high. Under that scoring, the vulnerability has a local wireless attack path and does not require privileges, user interaction or additional attack conditions. The impact is rated high for integrity and availability, while the advisory does not assign a confidentiality impact.

The advisory identifies the issue as a use of hard-coded credentials, corresponding to CWE-798. It classifies the affected equipment under the Healthcare and Public Health critical infrastructure sector and lists worldwide deployment. The advisory identifies Sweden as the company headquarters location.

Users are encouraged to install the latest firmware updates provided by Flow Neuroscience through the Flow app. The advisory does not provide a separate version range beyond identifying the listed FL-100 products as affected. Applying the available firmware update is the primary product-specific mitigation described by CISA.

CISA also recommends minimizing network exposure for control-system devices and related systems. Organizations should ensure those devices are not accessible from the internet, place control-system networks and remote devices behind firewalls, and isolate them from business networks. These measures are intended to reduce the opportunities for unauthorized access to systems connected to operational or healthcare environments.

When remote access is necessary, CISA recommends using more secure methods such as virtual private networks. The agency cautions that VPNs can also have vulnerabilities and should be kept current, and that a VPN is only as secure as the devices connected to it. CISA advises organizations to conduct appropriate impact analysis and risk assessments before deploying defensive measures.

The agency directs organizations to its control-systems security guidance and related cybersecurity practices for additional recommendations. It also advises organizations that observe suspected malicious activity to follow established internal procedures and report findings to CISA for tracking and correlation with other incidents.

A.C. Buglione reported the vulnerability to CISA, according to the advisory. CISA said no known public exploitation specifically targeting the vulnerability had been reported at the time of publication. The advisory was issued as an initial publication on Aug. 13.