CISA Advises on Critical Bluetooth Vulnerability in Pulsetto Vagus Nerve Stimulator

The Cybersecurity and Infrastructure Security Agency (CISA) has published industrial control system medical advisory ICSMA-26-223-02 addressing a vulnerability in the Pulsetto Vagus Nerve Stimulator. According to the advisory, the firmware of the affected product accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on.

Successful exploitation of this vulnerability could allow an attacker to use hidden commands to disable electrical safety mechanisms or modify other stimulation output settings. The vulnerability affects all versions of the Pulsetto Vagus Nerve Stimulator (vers:all/*).

The CVSS 3.1 base score for CVE-2026-18844 is 8.1, classified as HIGH. The vector string is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. A second CVSS 4.0 vector (CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N) also rates the severity as HIGH with a score of 7.2.

The affected equipment falls under the Healthcare and Public Health critical infrastructure sector. The vendor, Pulsetto, has its headquarters in Lithuania and the device is deployed worldwide.

CISA acknowledges that Pulsetto has not responded to requests to work with the agency to mitigate this vulnerability. Users are encouraged to reach out directly to Pulsetto for assistance at info@pulsetto.tech. No firmware patch has been publicly disclosed in the advisory. The relevant CWE identifier is CWE-912 (Hidden Functionality).

CISA recommends users take defensive measures to minimize the risk of exploitation, including minimizing network exposure for control system devices, locating control system networks behind firewalls and isolating them from business networks, and using secure methods such as VPNs when remote access is required. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.