CVE-2026-18164

7.2 highEPSS 0.4%

High (7.2). EPSS 0.4% chance of exploitation in the next 30 days.

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state.

Severity

CVSS 4.0

7.2 high

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

8.1 high

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-31)
CWE: CWE-798
Published: 2026-08-13
Modified: 2026-09-08
Record from: the NVD, synced 2026-10-19

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-225-01.json
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-225-01

Check your stack JSON