CISA ICSMA-26-288-01: Path Traversal in Thermo Fisher Torrent Suite Puts Genomic Data at Risk
In October 2026, CISA published ICS Medical Advisory ICSMA-26-288-01 disclosing a path traversal vulnerability (CVE-2026-107777, CWE-22) in Thermo Fisher Scientific's Torrent Suite Software versions 5.18 and earlier, a genomic sequencing platform widely deployed in healthcare and public health environments worldwide. An authenticated remote attacker can exploit the flaw by sending a crafted HTTP request that escapes the application's restricted directory, allowing arbitrary file reads on the underlying Torrent Server under the privileges of the web service account. Scored CVSS 3.1 at 6.5 (Medium) and CVSS 4.0 at 7.1 (High), the vulnerability exposes sensitive genomic, patient, and configuration data without requiring user interaction or elevated credentials beyond basic authentication. Thermo Fisher resolved the issue in Torrent Suite Software version 5.22. Path traversal flaws in medical and ICS devices continue to be a primary vector for healthcare data breaches, with CISA and HHS reporting a sustained increase in targeted exploitation of unpatched clinical informatics platforms. The convergence of genomic research infrastructure with internet-accessible deployment architectures elevates the risk profile well beyond traditional IT vulnerabilities, making timely patching and network segmentation operationally critical.
Kill Chain
