PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-52866 Apollo Pharmacy CVE debrief

CVE-2026-52866 is a HIGH-severity vulnerability allowing an attacker within BLE communication range to monopolize a device's only available BLE connection slot. This prevents legitimate users or applications from establishing a connection. The vulnerability has a CVSS score of 7.1 and was published on June 19, 2026. Organizations using BLE-enabled devices should assess their exposure and implement mitigations. The vendor and product details are not confirmed, but there is a potential link to Apollopharmacy. CISA and ICS-CERT have provided advisories and resources for understanding Bluetooth technology and mitigating ICS vulnerabilities.

Vendor
Apollo Pharmacy
Product
Blood Glucose Monitoring System (Model No. APG-01 BT)
CVSS
HIGH 7.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-19
Original CVE updated
2026-06-22
Advisory published
2026-06-19
Advisory updated
2026-06-22

Who should care

Organizations using BLE-enabled devices, particularly those in industrial control systems (ICS) and medical devices, should be aware of this vulnerability. Healthcare and manufacturing sectors may be affected due to the potential link to Apollopharmacy and ICS applications.

Technical summary

The vulnerability allows an attacker within BLE communication range to monopolize the device's only available BLE connection slot. This is achieved by exploiting the device's BLE connection management, preventing legitimate users or applications from establishing a connection. The CVSS vector is CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X, indicating a High severity.

Defensive priority

High

Recommended defensive actions

  • Implement secure BLE connection management practices
  • Limit BLE communication range to authorized areas
  • Use secure authentication and authorization for BLE connections
  • Regularly update and patch BLE-enabled devices
  • Monitor BLE device activity for suspicious connections
  • Use CISA and ICS-CERT advisories for understanding Bluetooth technology and mitigating ICS vulnerabilities
  • Assess exposure and implement mitigations based on organizational risk assessment

Evidence notes

The vulnerability details are based on information from the NVD and CISA/ICS-CERT advisories. The vendor and product details are not confirmed, but there is a potential link to Apollopharmacy. The CVSS score and vector are provided by the NVD.

Official resources

CVE-2026-52866 was published on June 19, 2026, with no modifications recorded.