Users should update the Mira app to the latest version (iOS v3.5.18 / Android v4.5.18). Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required beyond applying these updates. Organizations deploying Mira devices should ensure all units are running the latest firmware and app versions and monitor for future security advisories from Quanovate Tech Inc.
Quick answers
What is CVE-2026-66098?
Users should update the Mira app to the latest version (iOS v3.5.18 / Android v4.5.18). Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required beyond applying these updates. Organizations deploying Mira devices should ensure all units are running the latest firmware and app versions and monitor for future security advisories from Quanovate Tech Inc.
How severe is CVE-2026-66098?
critical, CVSS 9.8
Is CVE-2026-66098 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-66098 be mitigated?
Users should update the Mira app to the latest version (iOS v3.5.18 / Android v4.5.18). Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required beyond applying these updates. Organizations deploying Mira devices should ensure all units are running the latest firmware and app versions and monitor for future security advisories from Quanovate Tech Inc.
CVSS
9.8
Vendor
Quanovate Tech Inc.
Published
Sep 30, 2026 · 08:05
Patch
Unknown / not confirmed
Affected products
Mira Hormone Monitor, Mira Android App
Mitigation
Users should update the Mira app to the latest version (iOS v3.5.18 / Android v4.5.18). Firmware v01.07.01.53 is updated via the app when the device is connected. No additional action is required beyond applying these updates. Organizations deploying Mira devices should ensure all units are running the latest firmware and app versions and monitor for future security advisories from Quanovate Tech Inc.
CISA has issued an advisory detailing eight vulnerabilities in the Mira Hormone Monitor firmware (v1.7.1.47) and Mira Android App (v4.5.15.4). The flaws range from critical severity with CVSS scores up to 9.8, enabling remote unauthenticated attackers within BLE range to rebind devices to attacker-controlled accounts, extract cleartext health data, cause denial-of-service conditions, and inject forged hormone measurements. Users are advised to update the Mira app and firmware immediately.