PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-52866 Apollo Pharmacy CVE debrief

CVE-2026-52866 is a HIGH-severity vulnerability allowing an attacker within BLE communication range to monopolize a device's only available BLE connection slot. This prevents legitimate users or applications from establishing a connection. The vulnerability has a CVSS score of 7.1 and was published on June 19, 2026. Organizations using BLE-enabled devices should assess their exposure and implement mitigations. The vendor and product details are not confirmed, but there is a potential link to Apollopharmacy. CISA and ICS-CERT have provided advisories and resources for understanding Bluetooth technology and mitigating ICS vulnerabilities.

Vendor
Apollo Pharmacy
Product
Blood Glucose Monitoring System (Model No. APG-01 BT)
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-18
Original CVE updated
2026-06-18
Advisory published
2026-06-18
Advisory updated
2026-06-18

Who should care

Organizations using BLE-enabled devices, particularly those in industrial control systems (ICS) and medical devices, should be aware of this vulnerability. Healthcare and manufacturing sectors may be affected due to the potential link to Apollopharmacy and ICS applications.

Technical summary

The vulnerability allows an attacker within BLE communication range to monopolize the device's only available BLE connection slot. This is achieved by exploiting the device's BLE connection management, preventing legitimate users or applications from establishing a connection. The CVSS vector is CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X, indicating a High severity.

Defensive priority

High

Recommended defensive actions

  • Implement secure BLE connection management practices
  • Limit BLE communication range to authorized areas
  • Use secure authentication and authorization for BLE connections
  • Regularly update and patch BLE-enabled devices
  • Monitor BLE device activity for suspicious connections
  • Use CISA and ICS-CERT advisories for understanding Bluetooth technology and mitigating ICS vulnerabilities
  • Assess exposure and implement mitigations based on organizational risk assessment

Evidence notes

The vulnerability details are based on information from the NVD and CISA/ICS-CERT advisories. The vendor and product details are not confirmed, but there is a potential link to Apollopharmacy. The CVSS score and vector are provided by the NVD.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-52866 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-52866

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-52866 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-52866

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.