Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT

The Apollo Pharmacy APG-01 BT blood glucose monitor contains two serious vulnerabilities: one allowing passive interception of sensitive health data over Bluetooth Low Energy (CVE-2026-50034), and another enabling denial-of-service by monopolizing the device's single connection slot (CVE-2026-52866). These flaws are particularly dangerous because they target a medical device that handles protected health information (PHI), meaning real patients could have their glucose readings exposed or be locked out of a life-relevant monitoring tool. The situation is compounded by Apollo Pharmacy's failure to respond to CISA's coordination requests, leaving users with no vendor-issued remediation path. This highlights the broader risk of IoT and connected medical devices entering the market without adequate security validation or post-market vulnerability response processes.