CISA flags Bluetooth flaw in Pulsetto stimulator that could alter settings

By Atlas Watchline Staff · Regulatory · August 11, 2026

CISA said a Bluetooth Low Energy flaw in Pulsetto’s vagus nerve stimulator could let an attacker send hidden commands that change output settings or disable safety mechanisms.

CISA on 2026-08-11 published an industrial control systems medical advisory for the Pulsetto Vagus Nerve Stimulator, warning that the device accepts several undisclosed commands over its Bluetooth Low Energy, or BLE, interface.

The agency said the issue, tracked as CVE-2026-18844, could allow an attacker to use hidden commands to disable electrical safety mechanisms or modify other stimulation output settings. CISA rated the flaw high severity, with a CVSS v3.1 base score of 8.1 and a CVSS v4.0 base score of 7.2.

CISA said the vulnerability affects the Pulsetto Vagus Nerve Stimulator from vendor Pulsetto and is listed for vers:all/*.

The agency classified the problem as CWE-912, or hidden functionality. The advisory said the commands are sent without authentication or encryption, are not issued by the companion mobile application, and are still processed by the device when it is powered on.

CISA said no known public exploitation specifically targeting the vulnerability has been reported to the agency at this time, and that the issue is not exploitable remotely.

In the advisory’s background section, CISA identified the company headquarters location as Lithuania. The notice also said Pulsetto had not responded to requests to work with CISA to mitigate the vulnerability.

CISA acknowledged A.C. Buglione as the reporter of the vulnerability and directed users to info@pulsetto.tech for assistance.

Sources

• CISA ICS Medical Advisory ICSMA-26-223-02

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.