The practical danger is not a remote internet takeover. CISA says the flaw cannot be exploited remotely and has no reported public exploitation. But proximity is the relevant boundary here: an attacker within Bluetooth range of a powered-on unit could communicate with the stimulator without authentication or encryption, bypassing the controls a customer sees in Pulsetto’s mobile app.
CISA says Pulsetto did not respond to its requests to coordinate a mitigation. There is no firmware update, affected-build list, workaround, or timeline in the advisory. The agency’s product entry is unusually broad: it marks Pulsetto Vagus Nerve Stimulator versions “all” as affected.
Hidden BLE commands bypass the app’s control model
The core finding is not simply that Pulsetto uses Bluetooth. The company openly describes Bluetooth pairing as part of setup and sells the device around app-guided programs, intensity controls, and session tracking. Its own support material says users can alter left- and right-side intensity in the app, while its storefront advertises five stimulation programs including stress relief, anxiety management, deep sleep, burnout recovery, and pain management.
CISA’s disclosure says the firmware accepts several undisclosed commands that are never issued by the companion application. Those commands are processed whenever the unit is powered on despite lacking encryption and authentication.
That means the app is not the security boundary Pulsetto’s customer experience implies. A user may pair the device only with their own iPhone or Android handset and still be exposed to a separate Bluetooth command path that the app neither presents nor authorizes. In security terms, the BLE service has functionality outside the documented interface, a weakness cataloged as CWE-912, Hidden Functionality.
CISA’s description is also more serious than a routine unauthorized configuration change. It says successful exploitation could disable electrical safety mechanisms or modify other stimulation-output settings. The agency assigned a CVSS 3.1 score of 8.1 out of 10 and a CVSS 4.0 score of 7.2, both rated High. The lower CVSS 4.0 number should not be mistaken for a reduced finding: both scores reflect the same important limits and risks—physical proximity is required, but no prior access, account, pairing authorization, or user interaction is needed.
The advisory does not identify the hidden commands, state which safeguards they can disable, quantify the altered electrical output, or say whether a malformed command can keep stimulation running beyond a normal session. Those omissions are understandable from a responsible-disclosure standpoint, but they leave device owners unable to assess the difference between a nuisance setting change and an output level outside Pulsetto’s intended safety envelope.
“General wellness” status does not eliminate an electrical safety problem
Pulsetto describes its device as a general wellness product rather than a medical device and says it is not intended to diagnose, treat, cure, or prevent disease. That positioning has regulatory significance: the FDA’s general-wellness policy is intended for low-risk products that promote a healthy lifestyle without making disease-treatment claims.
But the security consequence here is tied to what the hardware physically does, not the marketing category attached to it. Pulsetto delivers electrical impulses through contact points placed at the neck. The company advises users not to use it while driving or operating machinery, lists implantable electronic devices and neck-area metal implants as contraindications, and says it has not evaluated safety in people with several cardiovascular conditions, arrhythmias, seizure histories, or other specified circumstances.
Those warnings make CISA’s reference to disabled electrical safety mechanisms especially consequential. The concern is not that a hostile command could expose a private wellness score; it is that the command path reaches a device intentionally designed to stimulate near the vagus nerve, which has effects associated with heart rate and autonomic nervous-system activity.
There is one voluntary adverse-event report in the FDA’s MAUDE database involving a Pulsetto unit, submitted after a user reported palpitations and ventricular arrhythmias following use in October 2025. That report should not be treated as proof that Pulsetto caused the event, much less as evidence that CVE-2026-18844 has harmed anyone. The FDA explicitly warns that MAUDE reports are unverified, cannot establish causation, and cannot be used to calculate incident rates.
It does, however, underline why this is a safety-control issue rather than an abstract BLE protocol defect. Pulsetto’s own contraindications acknowledge that electrical stimulation near the neck is not appropriate for every user. A flaw that can allegedly override safety functions raises the stakes for users who may not know they have an underlying vulnerability or who rely on the device’s documented output limits.
No patch means there is no user-side technical fix
CISA’s remediation section contains no version number, firmware package, pairing reset procedure, service-disable switch, or recommended Bluetooth configuration. Instead, the agency says Pulsetto did not respond to coordination requests and directs customers to contact the company themselves.
That leaves affected owners with a problem familiar to enterprise Bluetooth device management but rare in consumer wellness hardware: all installed units are presumed affected, while none have a published remediation path. Updating the Pulsetto Wellness app is not an adequate answer unless Pulsetto confirms that an app update also delivers and installs firmware that removes or authenticates the hidden command interface. CISA’s advisory does not say that such a firmware channel exists.
The agency’s general advice about isolating industrial-control networks and using VPNs plainly does not translate cleanly to a personal stimulator worn around the neck. The useful takeaway from the advisory is narrower:
- Owners should contact Pulsetto and request a written statement on whether their specific model and firmware are affected, whether Bluetooth can be disabled without disabling normal operation, and when a signed firmware remediation will be available.
- Organizations that buy or recommend Pulsetto units for employee wellness, rehabilitation, research, or patient-adjacent programs should inventory the devices now rather than assuming they are ordinary consumer accessories outside security review.
- Users should treat a powered-on Pulsetto device as a local wireless attack surface and avoid using it in situations where an untrusted person can remain nearby during a session.
The third point is an operational mitigation, not a repair. CISA does not publish a tested way for customers to prevent unauthenticated BLE commands while continuing normal use. Nor does it state Bluetooth range, whether the attacker must know a device identifier, whether commands can be issued during an active session only, or whether the device provides any local indication that its settings have been changed.
Pulsetto needs to answer the questions CISA could not
The disclosed version scope creates another unresolved issue. CISA names the affected product as “Pulsetto Vagus Nerve Stimulator” and uses the broad “all versions” notation, but does not separately identify Pulsetto Lite, Pulsetto FIT, regional variants, hardware revisions, or refurbished units. Pulsetto’s current store sells multiple product names, and the advisory offers no model-number mapping.
That lack of precision matters for support teams and retailers. A customer who owns an older original Pulsetto has no way to know from the advisory whether the finding also applies to a newer model, while a customer with a newer model has no basis to assume a name change means the BLE implementation changed. Until Pulsetto publishes a device-by-device statement, the prudent reading is that any product marketed under the advisory’s affected name should be regarded as exposed.
CISA credits security researcher A.C. Buglione with reporting the vulnerability and says no public exploitation targeting CVE-2026-18844 is known. The absence of reported attacks is welcome, but it does not resolve the central defect: a physical-output device accepts undocumented, unauthenticated wireless commands while powered on.
For Pulsetto owners, the immediate issue is no longer whether the companion app can set a comfortable stimulation level. It is whether the company will provide a verifiable firmware fix for the command interface that bypasses the app entirely.
