Security flaws in Quanovate Tech’s Mira Hormone Monitor and Android app could allow attackers to access reproductive health information, alter records, disrupt device operation and obtain control of user accounts, the Cybersecurity and Infrastructure Security Agency said in an advisory. The affected products are Mira Monitor firmware 1.7.1.47 and Mira Android app version 4.5.15.4. CISA lists the products under the Healthcare and Public Health sector and says they are deployed worldwide.

The advisory identifies eight vulnerabilities, including several with critical or high severity ratings. The highest-rated issue, CVE-2026-68067, affects the Mira cloud API’s login endpoint. It accepts any format-valid string in the password field and returns an active session token for the account associated with a supplied email address. An attacker could use that token to control cloud accounts and access hormone records and account settings. CISA assigns the flaw a CVSS 3.1 score of 9.8.

Another critical vulnerability, CVE-2026-67568, is present in the distributed Android application. It could give an attacker read and write access to reproductive health profiles from internet-connected hosts, allowing health information to be forged, deleted or destroyed. CISA assigns this issue a CVSS 3.1 score of 9.1 and attributes it to the use of hard-coded credentials.

The cloud authentication system also lacks per-account rate limiting, per-IP throttling and account lockout after repeated failed login attempts, according to the advisory. The weakness, tracked as CVE-2026-66340, could enable brute-force attempts against user accounts. CISA rates it medium severity with a CVSS 3.1 score of 5.3.

Bluetooth exposure creates a separate path for attacks near the monitor. In firmware version 1.7.1.47, an unauthenticated attacker within approximately 10 to 30 meters could silently rebind the device to an account controlled by the attacker, extract stored hormone measurements in cleartext, trigger denial of service through malformed or undocumented command opcodes, and passively track the user through a static random Bluetooth address that does not rotate. CISA tracks those behaviors under CVE-2026-66875 and rates it high severity with a CVSS 3.1 score of 8.8.

The firmware also accepts an unauthenticated 0x01 write from any Bluetooth central, causing the monitor to reboot into bootloader mode. CISA says CVE-2026-66098 could cause a denial-of-service condition or disrupt ovulation tracking and fertility-monitoring workflows. The advisory rates that issue medium severity under CVSS 3.1, with a score of 6.5.

The Android app’s device-pairing process provides another Bluetooth weakness. Version 4.5.15.4 identifies a paired analyzer using only a substring match against the Bluetooth advertisement name, without cryptographic peripheral authentication, a MAC-address allowlist or a bonded-identity check. An attacker could capture live session-token information and inject forged hormone measurements into a victim’s cloud record and clinical trend view. CISA identifies this as CVE-2026-67558 and rates it high severity with a CVSS 3.1 score of 7.4.

An additional flaw affects the accuracy of device security information. The cloud API accepts the firmware version reported by the companion app as authoritative without independently attesting the version from the monitor. An authenticated attacker could submit an arbitrary version for that person’s device, evade vulnerable-fleet analytics, suppress security-update prompts and misrepresent patch-adoption metrics, according to CISA. The advisory identifies this as CVE-2026-64934 and rates it medium severity. CISA’s summary also lists CVE-2026-66832 among the affected vulnerabilities.

CISA directs users to update the Mira app to iOS version 3.5.18 or Android version 4.5.18. When the monitor connects to the updated app, firmware version 01.07.01.53 is installed through the app. The advisory says no additional action is required after that update path is completed.