CISA warns of hard-coded credential flaw in Flow Neuroscience FL-100 devices

By Atlas Watchline Staff · Regulatory · August 13, 2026

CISA said a Bluetooth-range flaw in Flow Neuroscience FL-100 devices could let an attacker bypass authentication and change brain stimulation settings.

CISA issued a cybersecurity advisory on Aug. 13, 2026, warning that Flow Neuroscience FL-100 devices have a Bluetooth-range vulnerability tied to hard-coded credentials.

The agency said the flaw, tracked as CVE-2026-18164, could allow an attacker near the device to bypass authentication, manipulate brain stimulation parameters and override safety limits. CISA rated the issue high severity under both CVSS v3.1, at 8.1, and CVSS v4.0, at 7.2.

Impact

CISA said the issue affects devices used in the healthcare and public health sector and that the product is deployed worldwide. The advisory lists the affected status as known_affected for Flow Neuroscience FL-100 and Halo Neuroscience FL-100 variants before July 2026.

The agency said the vulnerability is not remotely exploitable, but that an attacker within Bluetooth range could arbitrarily manipulate the device’s brain stimulation state. CISA summarized the potential impact as manipulation of brain stimulation parameters and safety limits.

Background

CISA classified the flaw as CWE-798, or use of hard-coded credentials. According to the advisory, an undocumented credential shared by all device units can bypass authentication. The affected vendor is Flow Neuroscience, which CISA lists as headquartered in Sweden.

CISA said no known public exploitation specifically targeting the vulnerability had been reported to the agency at the time of publication. The advisory references A.C. Buglione as the reporter.

What CISA said

CISA advised users to install the latest firmware updates provided by Flow Neuroscience through the Flow app.

Next steps

Users and health-care operators with affected devices will need to review firmware status and apply the vendor update path named in the advisory. CISA’s notice remains the main public guidance cited in the filing.

Sources

• CISA ICS Medical Advisory page
• CISA CSAF file referenced in the advisory
• CVE record for CVE-2026-18164

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.