Is CVE-2026-67568 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-67568 being exploited in the wild.

How severe is CVE-2026-67568?

Critical severity, with a CVSS score of 9.1, published 11 August 2026.

Which products and versions are affected?

Quanovate Tech Inc. Mira Android App 4.5.15.4; Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47.

Is there a fix for CVE-2026-67568?

A patch was published on 2026-08-11: Android app v4.5.18, Firmware v01.07.01.53 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-67568 attacked?

It is attacked from the adjacent network, in a web application.

Am I affected by CVE-2026-67568?

Check whether you run Quanovate Tech Inc. Mira Android App or Quanovate Tech Inc. Mira Monitor Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-67568: Mira Android App data access vulnerability

CVE-2026-67568 · Severity: critical · CVSS 9.1 · Published 2026-08-11

Mira is a fertility and hormone tracking application used by consumers to monitor reproductive health through a companion wearable device. A critical vulnerability in the Android app version 4.5.15.4 allows attackers on a local network to read and modify sensitive health profile data without authentication, enabling attackers to alter medical records, impersonate users, or disrupt fertility tracking.

Technologies: Quanovate Tech Inc. Mira Android App, Quanovate Tech Inc. Mira Monitor Firmware. Vendors: Quanovate Tech Inc..

Quick answers

Is CVE-2026-67568 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-67568 being exploited in the wild.
How severe is CVE-2026-67568?: Critical severity, with a CVSS score of 9.1, published 11 August 2026.
Which products and versions are affected?: Quanovate Tech Inc. Mira Android App 4.5.15.4; Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47.
Is there a fix for CVE-2026-67568?: A patch was published on 2026-08-11: Android app v4.5.18, Firmware v01.07.01.53 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67568 attacked?: It is attacked from the adjacent network, in a web application.
Am I affected by CVE-2026-67568?: Check whether you run Quanovate Tech Inc. Mira Android App or Quanovate Tech Inc. Mira Monitor Firmware at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Mira Android app v4.5.15.4 relies on insecure device pairing mechanisms, using only substring matching of BLE advertisement names without cryptographic authentication, MAC allowlists, or bonded-identity verification. This authentication bypass allows attackers within Bluetooth range (approximately 10–30 meters) to intercept session tokens and inject forged hormone measurements. An attacker can read/write reproductive health profiles from internet-connected hosts without credentials, leading to unauthorized disclosure, modification, and deletion of sensitive health information. Affected firmware version 1.7.1.47 compounds the issue by accepting unauthenticated BLE commands. Patches are available: Android v4.5.18 and Firmware v01.07.01.53.

Affected products

Quanovate Tech Inc. Mira Android App 4.5.15.4
Quanovate Tech Inc. Mira Monitor Firmware 1.7.1.47

Timeline

2026-08-11: disclosed
2026-08-11: patched: Android app v4.5.18, Firmware v01.07.01.53

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.