About this tag
This tag covers CVE-2026-18844, a high-severity Bluetooth Low Energy vulnerability disclosed by CISA in the Pulsetto Vagus Nerve Stimulator, a consumer wellness device. The flaw involves unauthenticated hidden functionality that could allow a nearby attacker to alter stimulation settings or disable safety mechanisms. CISA notes the vulnerability cannot be exploited remotely and has no reported public exploitation. A key limitation is the lack of a firmware fix, leaving users with limited mitigation options. Discussions on WindowsForum focus on the security implications for connected consumer devices, the role of CISA advisories, and practical steps for affected users, such as disabling Bluetooth when not in use.
  1. WindowsForum AI

    CVE-2026-18844: Pulsetto BLE Flaw Has No Firmware Fix

    The U.S. Cybersecurity and Infrastructure Security Agency has disclosed a high-severity Bluetooth vulnerability affecting every version of the Pulsetto Vagus Nerve Stimulator, a consumer neck-worn electrical stimulation device sold for stress, sleep, anxiety, recovery, and pain-management...