Apollo glucose monitor exposes patient data via BLE
Two Bluetooth Low Energy vulnerabilities in Apollo Pharmacy's APG-01 BT glucose monitor allow attackers to intercept patient glucose readings and block legitimate connections.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has disclosed two vulnerabilities in Apollo Pharmacy's Blood Glucose Monitoring System (Model APG-01 BT, version 0x0110_v1.1.0) affecting devices deployed in India. CVE-2026-50034 enables attackers within BLE range to passively intercept wireless communications and obtain sensitive health information, including glucose measurement values, due to cleartext transmission. CVE-2026-52866 allows an attacker to monopolize the device's single BLE connection slot through a missing authorization weakness, creating a denial-of-service condition that prevents legitimate users from connecting.
The vulnerabilities require physical proximity to exploit and are not remotely exploitable. Apollo Pharmacy did not respond to CISA's coordination attempts, and no vendor patches are currently available. CISA recommends users contact Apollo Pharmacy directly and follow general Bluetooth security guidance. No public exploitation targeting these specific vulnerabilities has been reported at this time.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-169-01
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs