CVE-2026-18164
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker within Bluetooth range to manipulate brain stimulation parameters and override safety limits. The following versions of Flow Neuroscience FL-100 are affected: Flow Neuroscience FL-100 Halo Neuroscience FL-100 CVSS Vendor Equipment Vulnerabilities v3 8.1 Flow Neuroscience Flow Neuroscience FL-100 Use of Hard-coded Credentials Background Critical Infrastructure Sectors: Healthcare and Public Health Countries/Areas Deployed: Worldwide Company Headquarters Location: Sweden Vulnerabilities Expand All + CVE-2026-18164 An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarilymanipulate brain stimulation parameters and state. View CVE Details Affected Products Flow Neuroscience FL-100 Vendor: Flow Neuroscience Product Version: Flow Neuroscience Flow Neuroscience FL-100: <July_2026, Flow Neuroscience Halo Neuroscience FL-100: <July_2026 Product Status: known_affected Remediations Mitigation Users are encouraged to install the latest firmware updates provided by Flow Neuroscience via the Flow app. Relevant CWE: CWE-798 Use of Hard-coded Credentials Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.1 HIGH CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H 4.0 7.2 HIGH CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N Acknowledgments A.C. Buglione reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. Locate control system networks and remote d
CSIRTS triage
- What
- Hard-coded Bluetooth credential shared across all device units allowing authentication bypass and manipulation of brain stimulation parameters.
- Who is affected
- All Flow Neuroscience FL-100 Halo Neuroscience devices.
- Urgency
- Critical; shared hard-coded credential enables remote safety parameter override via Bluetooth.
- Action
- Contact vendor for firmware update addressing hard-coded credential removal.
AI-assisted analysis generated from the source advisory — verify against the original.
⚡ Watch CVE-2026-18164
Get an email if CVE-2026-18164 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.
Exploitation outlook
- Low exploitation risk0.23% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 14% of all EPSS-scored CVEs.
Advisory coverage (2)
- highCVE-2026-18164: An undocumented hard-coded credential, shared by all device units, is authorized to bypass aut…nvd · 2026-08-13
- criticalFlow Neuroscience FL-100cisa · 2026-08-13
External references
Embed the live status
— this badge updates automatically when the KEV or exploit status changes. How to embed it →
[](https://www.csirts.com/cve/CVE-2026-18164)