CISA ICSMA-26-288-01: Path Traversal in Thermo Fisher Torrent Suite Puts Genomic Data at Risk
Executive Summary
In October 2026, CISA published ICS Medical Advisory ICSMA-26-288-01 disclosing a path traversal vulnerability (CVE-2026-107777, CWE-22) in Thermo Fisher Scientific's Torrent Suite Software versions 5.18 and earlier, a genomic sequencing platform widely deployed in healthcare and public health environments worldwide. An authenticated remote attacker can exploit the flaw by sending a crafted HTTP request that escapes the application's restricted directory, allowing arbitrary file reads on the underlying Torrent Server under the privileges of the web service account. Scored CVSS 3.1 at 6.5 (Medium) and CVSS 4.0 at 7.1 (High), the vulnerability exposes sensitive genomic, patient, and configuration data without requiring user interaction or elevated credentials beyond basic authentication. Thermo Fisher resolved the issue in Torrent Suite Software version 5.22.
Path traversal flaws in medical and ICS devices continue to be a primary vector for healthcare data breaches, with CISA and HHS reporting a sustained increase in targeted exploitation of unpatched clinical informatics platforms. The convergence of genomic research infrastructure with internet-accessible deployment architectures elevates the risk profile well beyond traditional IT vulnerabilities, making timely patching and network segmentation operationally critical.
Why This Matters Now
Healthcare OT and clinical informatics platforms like Torrent Suite are increasingly networked and cloud-adjacent, yet patch cycles lag enterprise IT by months or years. With genomic data now classified as sensitive PHI under evolving HIPAA guidance, a single unauthenticated file-read exploit can expose sequencing runs, patient identifiers, and server credentials—triggering HIPAA breach notification, research data loss, and potential regulatory fines at a time when HHS enforcement actions against healthcare technology vendors are accelerating.
Attack Path Analysis
An authenticated attacker exploited a path traversal vulnerability (CVE-2026-107777, CWE-22) in Thermo Fisher Torrent Suite Software versions 5.18 and below, leveraging valid low-privilege credentials to read arbitrary files accessible to the web service account on the Torrent Server. The attack progressed from initial web-based exploitation through file system enumeration and potential credential harvesting, enabling lateral movement within the healthcare network, culminating in exfiltration of sensitive genomic or configuration data — a significant risk given the critical healthcare and public health infrastructure context.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
An authenticated attacker with low-privilege access to the Torrent Suite Software web interface exploited the path traversal vulnerability (CVE-2026-107777) via crafted HTTP requests containing directory traversal sequences (e.g., '../../../etc/passwd'). The vulnerability requires only valid credentials (PR:L) over the network (AV:N) with no user interaction, making it accessible to any account holder or attacker who obtained credentials through prior phishing or credential stuffing.
Related CVEs
CVE-2026-107777
CVSS 6.5Thermo Fisher Torrent Suite Software versions 5.18 and earlier are vulnerable to a path traversal (CWE-22) that allows an authenticated remote attacker to read arbitrary files on the Torrent Server accessible to the web service account, potentially exposing sensitive genomic and configuration data.
Affected Products:
Thermo Fisher Scientific Torrent Suite Software – <= 5.18
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
File and Directory Discovery
Data from Local System
Exploit Public-Facing Application
Unsecured Credentials
Data from Cloud Storage
Application Layer Protocol
Valid Accounts
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
HIPAA Security Rule (45 CFR Part 164) – Access Control
Control ID: 164.312(a)(1)
NIST SP 800-53 Rev 5 – Information Input Validation
Control ID: SI-10
NIS2 Directive (EU) 2022/0383 – Supply Chain and System Security
Control ID: Article 21(2)(d)
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Application Access Authorization and Least Privilege
Control ID: Application Pillar — Pillar 4: Applications & Workloads
DORA (EU Regulation 2022/2554) – ICT Security — Access Controls and Vulnerability Management
Control ID: Article 9(4)(b)
ISO/IEC 27001:2022 – Secure Coding
Control ID: Annex A 8.28
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Health Care / Life Sciences
Thermo Fisher Torrent Suite Software path traversal (CVE-2026-107777) directly threatens genomic sequencing infrastructure, enabling authenticated attackers to exfiltrate sensitive patient and research data, violating HIPAA.164.312(e)(1) compliance requirements.
Biotechnology/Greentech
Vulnerability exploitation via CWE-22 path traversal exposes proprietary biological research data on Torrent Servers, with lateral movement risks compounded by insufficient east-west traffic segmentation across biotech lab networks.
Research Industry
Authenticated path traversal against Torrent Suite Software threatens confidential genomic and scientific datasets; absence of zero trust segmentation and egress policy enforcement amplifies exfiltration risk across research computing environments.
Pharmaceuticals
Torrent Suite Software exploitation enables arbitrary file reads on sequencing servers housing drug discovery data, with NIST.800-53.SC-7 and PCI compliance gaps increasing exposure to intellectual property theft via uncontrolled outbound traffic.
Sources
- Thermo Fisher Torrent Suite Softwarehttps://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01Verified
- NVD - CVE-2026-107777 Vulnerability Detailhttps://nvd.nist.gov/vuln/detail/CVE-2026-107777Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Thermo Fisher Scientific Security Bulletin - Torrent Suite Softwarehttps://www.thermofisher.com/us/en/home/life-science/sequencing/next-generation-sequencing/ion-torrent-next-generation-sequencing-workflow/ion-torrent-next-generation-sequencing-run-sequence/torrent-suite-software.htmlVerified
- CISA ICS Security Recommended Practices and Defense-in-Depth Strategieshttps://www.cisa.gov/icsVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is relevant here because the attacker relied on network reachability to the Torrent Suite web interface and uncontrolled east-west paths to pivot across the healthcare environment. By enforcing identity-aware segmentation and controlled egress, CNSF would likely reduce the attacker's ability to reach adjacent systems and exfiltrate harvested data at scale.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Enforcing identity-aware access policies around the Torrent Server would likely reduce the pool of network principals able to reach the vulnerable web interface, constraining initial attacker reachability even when valid credentials are present.
Control: Zero Trust Segmentation
Mitigation: Strict workload-level segmentation around the Torrent Server would likely constrain the scope of post-exploitation privilege escalation by limiting how harvested credentials could be reused to reach other segmented workloads or management planes.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement would likely reduce the attacker's ability to move freely between the Torrent Server and adjacent laboratory or clinical systems, constraining lateral reach even when valid harvested credentials are in hand.
Control: Multicloud Visibility & Control
Mitigation: Centralized visibility and control over outbound traffic from the Torrent Server would likely surface anomalous connection patterns, reducing the window during which covert C2 channels could operate undetected and constraining the attacker's ability to maintain persistent remote access.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement on traffic leaving the Torrent Server's network segment would likely constrain the volume and destinations through which harvested file content could be carried out, reducing the attacker's ability to exfiltrate at scale through unapproved outbound paths.
The practical blast radius of the incident would likely be reduced to the Torrent Server's own file scope, with harvested credentials having fewer viable targets due to segmentation, and exfiltration volume constrained by egress controls — limiting but not eliminating residual confidentiality impact.
Impact at a Glance
Affected Business Functions
- Genomic Sequencing Data Management
- Electronic Health Records (EHR) Integration
- Clinical Laboratory Information Systems (LIS)
- Bioinformatics Pipeline Operations
Estimated downtime: N/A
Estimated loss: N/A
An authenticated attacker exploiting this path traversal vulnerability could read arbitrary files accessible to the Torrent Server web service account. In healthcare and research environments, this may include genomic sequencing results, patient-linked research data, system configuration files containing credentials or API keys, log files with operational metadata, and potentially PHI-adjacent research datasets. The confidentiality impact is rated HIGH by CVSS, with no integrity or availability impact. No confirmed exploitation or data breach has been reported at time of advisory publication.
Recommended Actions
Key Takeaways & Next Steps
- • Apply the vendor patch immediately by upgrading Torrent Suite Software to version 5.22 or later, and enforce Zero Trust Segmentation (microsegmentation, identity-based policy) to restrict web service account access to only required file paths and internal resources, preventing path traversal from reaching sensitive system files.
- • Deploy East-West Traffic Security controls to monitor and restrict lateral movement from the Torrent Server to adjacent healthcare systems; workload-to-workload communication should require explicit policy authorization to prevent credential-harvesting from enabling network pivoting.
- • Implement Egress Security and Policy Enforcement with FQDN filtering and outbound traffic controls on the Torrent Server to detect and block anomalous outbound data transfers that may indicate file exfiltration via covert channels or unauthorized destinations.
- • Enable Multicloud Visibility and Control with centralized traffic observability to baseline normal Torrent Suite API call patterns and alert on repeated malformed or traversal-pattern HTTP requests, providing early detection of exploitation attempts before full exfiltration occurs.
- • Enforce Inline IPS (Suricata) inspection on inbound traffic to the Torrent Suite web interface to detect and block known path traversal exploit patterns and CVE-specific signatures, while ensuring the medical device network segment is isolated behind Cloud Firewall controls per CISA recommendations to minimize internet-facing exposure.
