Install the latest firmware updates provided by Flow Neuroscience via the Flow app. Minimize network exposure for all control system devices and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. Use secure methods such as VPNs when remote access is required, and keep VPN software updated. Perform impact analysis and risk assessment prior to deploying defensive measures.
Quick answers
What is CVE-2026-18164?
Install the latest firmware updates provided by Flow Neuroscience via the Flow app. Minimize network exposure for all control system devices and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. Use secure methods such as VPNs when remote access is required, and keep VPN software updated. Perform impact analysis and risk assessment prior to deploying defensive measures.
How severe is CVE-2026-18164?
high, CVSS 8.1
Is CVE-2026-18164 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-18164 be mitigated?
Install the latest firmware updates provided by Flow Neuroscience via the Flow app. Minimize network exposure for all control system devices and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. Use secure methods such as VPNs when remote access is required, and keep VPN software updated. Perform impact analysis and risk assessment prior to deploying defensive measures.
Install the latest firmware updates provided by Flow Neuroscience via the Flow app. Minimize network exposure for all control system devices and ensure they are not accessible from the internet. Locate control system networks and remote devices behind firewalls and isolate them from business networks. Use secure methods such as VPNs when remote access is required, and keep VPN software updated. Perform impact analysis and risk assessment prior to deploying defensive measures.
A critical vulnerability (CVE-2026-18164) affects Flow Neuroscience FL-100 and Halo Neuroscience FL-100 brain stimulation devices. An undocumented hard-coded credential, shared across all device units, permits attackers within Bluetooth range to bypass authentication. This could allow manipulation of brain stimulation parameters and override of safety limits, posing direct health risks to users. The advisory was published by CISA on August 13, 2026, following reporting by researcher A.C. Buglione. No public exploitation has been reported to date.