Pulsetto Vagus Nerve Stimulator

A CISA advisory describes a high-severity vulnerability (CVE-2026-18844, CVSSv3 8.1) in Pulsetto Vagus Nerve Stimulator devices: the firmware processes undisclosed Bluetooth Low Energy commands without authentication or encryption, potentially allowing attackers to disable electrical safety mechanisms or alter stimulation settings. The issue affects all reported versions, impacts healthcare infrastructure worldwide, and CISA provides mitigation guidance while noting no known public exploitation and that the vulnerability is not remotely exploitable.