CVE-2026-18844 Pulsetto CVE debrief

Who should care

Defenders responsible for managing and securing medical devices, particularly those using the Pulsetto Vagus Nerve Stimulator, should be aware of this vulnerability and take steps to verify their exposure and apply patches or compensating controls as needed.

Why it matters

CVE-2026-18844 is a HIGH-severity vulnerability in the Pulsetto Vagus Nerve Stimulator's firmware that allows undisclosed commands over BLE without authentication or encryption. Defenders should verify exposure, apply patches, and monitor device activity to prevent potential unauthorized access and impacts to device functionality and patient care.

• Defenders should verify the device's firmware version and apply patches to prevent potential unauthorized access
• Unpatched devices may be vulnerable to unauthorized commands, which could impact device functionality and patient care
• Defenders should monitor device activity for unusual behavior, as exploitation attempts may not be immediately detectable

Technical summary

The Pulsetto Vagus Nerve Stimulator's firmware accepts undisclosed commands over its Bluetooth Low Energy (BLE) interface without authentication or encryption. These commands are not issued by the companion mobile application but are fully processed by the device when powered on. This vulnerability has a CVSS score of 7.2 and is classified as HIGH severity. Affected product deployments should be identified in managed environments, and owners should be assigned for follow-up. The official advisory or CVE record should be reviewed to validate affected scope, severity, and vendor guidance.

Defensive priority

Defenders should prioritize verifying the device's firmware version and ensuring that any available patches are applied. They should also assess their exposure to this vulnerability and consider implementing compensating controls, such as monitoring for unusual device activity.

Recommended defensive actions

• Verify the device's firmware version and apply any available patches
• Assess exposure to this vulnerability and consider implementing compensating controls
• Monitor for unusual device activity
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, but the scope of affected versions and devices is not explicitly stated. The ICS-CERT advisories may provide additional context for defenders.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.