Thermo Fisher Patches Forensic DNA File Tampering Flaw in Its Software

Summary

Thermo Fisher Scientific has released security updates for five of its Applied Biosystems human identification products to address CVE-2026-17583, a vulnerability allowing undetectable changes to forensic DNA data files. The flaw, with a CVSS score of 8.2, impacts .fsa and .hid output files and could compromise forensic results if exploited. The patches add digital signatures to verify file integrity, though older, unsupported software versions will not receive updates.

Full text

SecurityThermo Fisher Patches Forensic DNA File Tampering Flaw in Its Software Thermo Fisher patched CVE-2026-17583 in five supported DNA analysis products by adding digital signatures that help laboratories detect modified forensic files. byDeeba AhmedAugust 4, 20262 minute read Listen to this article 0:00 — ← 10s ▶ Play 10s → Speed 0.75× 1× 1.25× 1.5× 2× Voice Loading voices… Press play to start listening Thermo Fisher Scientific has released security updates for several Applied Biosystems human identification products after researchers identified a vulnerability that could allow nearly undetectable changes to forensic DNA data files. The issue, tracked as CVE-2026-17583, carries a CVSS score of 8.2 out of 10 (CVSS 4.0). The vulnerability specifically impacts .fsa and .hid output files generated by human-identification software. Thermo Fisher credited Nathan Adams, Kevin Dyer, Laura Gaydosh Combs, and the Cybersecurity and Infrastructure Security Agency (CISA) with identifying and coordinating disclosure of the vulnerability. Exploitation would require laboratory controls to be bypassed, allowing .fsa and .hid files to be altered after generation but before they are loaded into analysis software. Because these files are used during human identification analysis, undetected changes could affect the reliability of forensic results. Affected Software and Updates The company released updates for five supported software products. The updates add digital signatures that allow laboratories to verify whether files have been modified. This protection applies to files generated after the updates are installed. 3500/3500xL Series Data Collection: Version 4.0.2 and earlier need to be updated to version 4.0.3. 3730/3730xL Series Data Collection: Version 5.0.2 and earlier need to be updated to version 5.0.3. SeqStudio Genetic Analyzer Data Collection: Versions 1.2.5 and earlier need to be updated to version 1.2.6. SeqStudio Flex Series Instrument: Versions 1.2.0 and earlier need to be updated to version 1.2.1. GeneMapper ID-X: Versions v1.7.3 and earlier need to be updated to version v1.7.4. For the SeqStudio Flex system with Security, Audit, and E-signature (SAE) features enabled, “the user must first install the latest SAE profile on the SAE Admin Console before installing the update,” the company noted in its official advisory (PDF). End-of-Life Software Will Not Receive Updates However, these fixes don’t apply to all devices. The company has clarified that not all software will receive a patch and that three older systems will not receive security updates because Thermo Fisher Scientific no longer supports them. These unsupported programs include the 3130 Series Data Collection version 4.1 and earlier, ABI PRISM 3100/3100-Avant Data Collection version 2.0 and earlier, and ABI PRISM 310 Data Collection version 3.1 and earlier. “As this software has reached its end-of-life and is no longer supported by Thermo Fisher Scientific, no update will be provided,” the company explained in the advisory. For laboratories unable to install the updates immediately, or those using unsupported software, Thermo Fisher recommends maintaining a secure chain of custody, storing files on encrypted and password-protected media, restricting access to authorized personnel, applying least-privilege permissions, and limiting internet connectivity to trusted sources through firewall rules and network access controls. (Photo by 铮 夏 on Unsplash) Deeba Ahmed Deeba is a veteran cybersecurity reporter at Hackread.com with over a decade of experience covering cybercrime, vulnerabilities, and security events. Her expertise and in-depth analysis make her a key contributor to the platform’s trusted coverage. View Posts CISACybersecurityForencisThermo FisherVulnerability Leave a Reply Cancel reply View Comments (0) Related Posts Read More Hacking News Privacy Security Smartwatch Users Beware – Report Identifies Vulnerabilities in Wearable Devices In the past, we reported how your wearable fitness trackers can be hacked. Now, The university of Illinois at Urbana-Champaign’s associate… byWaqas Read More Cyber Attacks Security Telegram messaging service hit by massive DDoS attack It is unclear why Telegram was targeted or who was behind the DDoS attack. The popular privacy-focused instant… byWaqas Read More Security Cyber Attacks CloudSEK Disputes Oracle Over Data Breach Denial with New Evidence Oracle is caught up in a cybersecurity mess right now, with claims about a massive data breach affecting… byWaqas Read More Hacking News Privacy Security Microsoft didn’t bat an eyelid to Chinese invasion into the privacy of Hotmail users Okay. This one’s quite a shock… According to a recent Reuters report, the Chinese government was supposedly behind… byAli Raza

Indicators of Compromise

• cve — CVE-2026-17583

Entities