CVE-2026-18844

Pulsetto Vagus Nerve Stimulator Hidden Functionality

CVSS 7.2 high · Pulsetto Vagus Nerve Stimulator · published 2026-08-11

The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on.

NVD · CVE.org

Coverage 1 source

1. 2026-08-11 CISA Cybersecurity Advisories high Pulsetto Vagus Nerve Stimulator

   A vulnerability in Pulsetto Vagus Nerve Stimulator could allow an attacker to disable electrical safety mechanisms or modify stimulation output settings.

Also covered

• CVE-2026-86950 Apple iOS and iPadOS CVSS 8.8 · 1 article · 2026-09-29
• CVE-2023-6548 Cloud Software Group NetScaler ADC CVSS 5.5 · 1 article · 2026-09-28
• CVE-2023-25608 Fortinet FortiAP-W2 CVSS 5.2 · 1 article · 2026-09-28
• CVE-2026-88772 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service CVSS 9.5 · 3 articles · 2026-09-28
• CVE-2026-88771 A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands CVSS 9.5 · 3 articles · 2026-09-28