As reported by CISA in ICS Medical Advisory ICSMA-26-223-02, a high-severity vulnerability has been disclosed in the Pulsetto Vagus Nerve Stimulator — a consumer and clinical-use wearable device that delivers electrical stimulation to the vagus nerve for stress and wellness applications. This advisory demands immediate attention from healthcare security teams, biomedical engineers, and risk managers.

Security Impact: As reported by CISA in ICS Medical Advisory ICSMA-26-223-02, a high-severity vulnerability has been disclosed in the Pulsetto Vagus Nerve Stimulator — a consumer and clinical-use wearable device that delivers electrical stimulation to the vagus nerve for stress and wellness applications.

Vulnerability At a Glance

CVE ID
CVE-2026-18844
CVSS v3 Score
8.1 — High
Vulnerability Type
Hidden Functionality (CWE-912)
Affected Vendor
Pulsetto (Headquarters: Lithuania)
Affected Product
Pulsetto Vagus Nerve Stimulator — All firmware versions
Attack Vector
Bluetooth Low Energy (BLE), no authentication, no encryption required
Exploitation Observed in the Wild
Not confirmed at time of advisory
Patch Available
Not specified in advisory — contact vendor and monitor CISA for updates
Deployment Scope
Worldwide, Critical Infrastructure Sector: Healthcare and Public Health

Why This Is More Than a Typical IoT Flaw

Most IoT vulnerabilities carry reputational or data-breach implications. This one carries a fundamentally different risk: direct physical harm to a patient or user. The ability to disable electrical safety mechanisms in a nerve stimulator — or arbitrarily modify stimulation output — transforms a wellness device into a potential instrument of injury. This places CVE-2026-18844 in the same category of concern as pacemaker and insulin pump vulnerabilities that have driven FDA regulatory scrutiny for nearly a decade.

What makes this particularly troubling is the attack surface. Bluetooth Low Energy operates over roughly 10 meters in open air, and in dense environments like hospitals, clinics, gyms, or even public transit, an attacker within range of a powered-on device can send these undisclosed commands with no pairing, authentication, or encryption required. The companion mobile application never issues these commands — meaning they exist purely as a hidden, undocumented interface. This is a textbook example of a backdoor-like design pattern in a medical device, whether intentional or a remnant of development tooling left in production firmware.

Who Is at Risk

Why This Is More Than a Typical IoT Flaw
Individual consumers using the Pulsetto device for personal wellness in public or semi-public spaces
Clinical environments where the device is recommended or integrated into patient care protocols
Healthcare delivery organizations (HDOs) that have not inventoried wearable and consumer-grade medical devices on their networks or in patient hands
Any organization whose employees use the device — particularly in high-security or sensitive environments where targeted harassment or harm could be motivated

Broader Implications for Medical Device Security

This advisory reinforces a persistent gap in the medical device security landscape: the proliferation of consumer-grade wellness devices that blur the line between lifestyle tech and regulated medical equipment. Unlike implantable devices subject to rigorous FDA pre-market review, many wearable stimulators occupy a regulatory gray zone — giving vendors less incentive to build security in by design.

When a device can be commanded over an open wireless channel to override its own safety mechanisms, the question is no longer just "is this device secure?" — it becomes "is this device safe?" Those are two very different standards, with very different liability implications.

The hidden command interface suggests that Pulsetto's firmware was either shipped with debug or factory commands still active, or that these commands were intentionally retained for undisclosed purposes. Either scenario represents a fundamental failure in secure development lifecycle (SDLC) practices and pre-market security testing.

Shield53 Recommendations

Immediate Actions

  • Inventory all Pulsetto devices within your organization or patient population. Because all firmware versions are affected, no version should be considered safe until a patch is confirmed and validated.
  • Contact Pulsetto directly to request a firmware update timeline, compensating controls, and a formal security advisory response. Demand written confirmation of their remediation plan.
  • Advise users to limit device use to trusted, low-density environments until a patch is available. Powering off the device when not actively in use eliminates the BLE attack window entirely.
  • Monitor the CISA ICS-CERT advisory page and NVD for CVE-2026-18844 updates, including any patch releases or additional technical indicators.
  • Do not rely on BLE range as a security control. Directional antennas and signal amplification can extend effective BLE attack range well beyond the nominal 10-meter specification.

For Healthcare Security Teams

  • Add Pulsetto devices to your biomedical device risk register immediately and flag for CISO and risk committee review.
  • Review your broader wearable and consumer medical device policy — this advisory is a prompt to ask whether your organization has visibility into BLE-capable devices brought in by patients or staff.
  • Engage your legal and compliance team regarding patient notification obligations, particularly if the device is used in clinical or recommended therapeutic contexts.
  • Reference FDA guidance on cybersecurity in medical devices and the IMDRF medical device security framework when developing your response posture.

The security community has long warned that the consumerization of medical technology would eventually produce scenarios where physical safety and cybersecurity converge. CVE-2026-18844 is exactly that scenario. Treat it with the urgency it demands.