CVE-2026-18844 describes a vulnerability in the Pulsetto Vagus Nerve Stimulator firmware where the device processes several undisclosed BLE commands without any authentication or encryption. These commands are not generated by the companion mobile app but are accepted and executed by the device when it is powered on. This hidden functionality could potentially be abused due to the lack of security controls on the BLE interface. The CVSS 4.0 score is 7.2, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, no user interaction, but high impact on confidentiality and availability.

An attacker within Bluetooth range could send unauthorized commands to the device without authentication or encryption, potentially leading to unauthorized control or disruption of the device's operation. The lack of authentication and encryption on the BLE interface increases the risk of unauthorized access. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or remediation level has been published. Until a patch or official mitigation is available, restricting physical and Bluetooth access to the device is recommended to reduce risk.