Loading story…
Thermo Fisher Scientific disclosed a high-severity vulnerability, CVE-2026-17583, in several Applied Biosystems Human Identification software products that could allow attackers to alter forensic DNA analysis files with little or no visible trace. The flaw affects .fsa and .hid files generated by forensic instruments and could impact evidence used in criminal investigations, paternity testing, and other identification workflows; researchers said the weakness may affect digital DNA scans dating back to 1995 and warned that manipulated profiles could influence convictions or acquittals.
Thermo Fisher said it has no evidence of active exploitation and assigned the issue a CVSS v4.0 score of 8.2, while releasing patched software that adds digital signatures to help laboratories verify file integrity after data leaves the instrument. The company also warned that some end-of-life platforms will not receive fixes, leaving them exposed unless they are retired or isolated, and recommended compensating controls including strict chain-of-custody procedures, encrypted storage, restricted access, least-privilege permissions, and network segmentation.
See real exploitation activity before you spend the cycle.
4 events from the most recent confirmed update back to the earliest known activity.
Thermo Fisher Scientific disclosed the high-severity vulnerability CVE-2026-17583 affecting Applied Biosystems Human Identification software products, warning that .fsa and .hid forensic DNA analysis files could be tampered with in ways that are virtually impossible to detect through normal review. The company assigned the flaw a CVSS v4.0 score of 8.2 and credited Nathan Adams, Kevin Dyer, Laura Gaydosh Combs, and CISA with identifying and coordinating responsible disclosure.
Thermo Fisher said several older platforms, including the 3130 Series and ABI PRISM 3100, 3100-Avant, and 310 Data Collection Software, have reached end-of-life and will not receive fixes for the vulnerability. The company recommended compensating controls such as secure chain-of-custody practices, encrypted storage, restricted access, least-privilege permissions, and network restrictions.
Thermo Fisher released updated versions of affected Applied Biosystems software, including 3500/3500xL, 3730/3730xL, SeqStudio, SeqStudio Flex, and GeneMapper ID-X, to address CVE-2026-17583. The patches add digital signatures so laboratories can verify that DNA analysis files were not altered after leaving the instrument.
A group of forensic and computer scientists identified a vulnerability in Thermo Fisher forensic software that could allow undetectable modification of digital DNA evidence, including adding or removing DNA profiles. Researchers said they could not find a reliable way to detect tampering once files were altered.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcehackread.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcedocuments.thermofisher.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Thermo Scientific **Xcalibur** and **Foundation** software for Windows were found to contain a local privilege escalation flaw tracked as `CVE-2024-55957`, caused by improper access controls that let low-privileged users overwrite executables and DLLs in the Thermo Foundation installation directory. Because one or more associated services run as `NT AUTHORITY\SYSTEM`, an attacker could replace service binaries or libraries and gain elevated privileges after a service restart or reboot. Tier Zero Security said it discovered the issue during an October 2024 engagement, and Thermo Fisher issued a security bulletin and patch on January 22, 2025. A later review found the fix was incomplete: in a new installation path, **Authenticated Users** still had full write permissions on service executables and DLLs, leaving the underlying escalation path in place. Tier Zero Security reported the residual issue to Thermo Fisher on February 8, 2025, and Thermo Fisher later updated its bulletin to instruct customers to contact technical support for a script to correct file permissions. At the time of the follow-up disclosure, no fully patched software release had been made publicly available, leaving affected organizations dependent on vendor guidance and manual remediation.
Aug 1, 2026
Eppendorf and CISA disclosed a critical vulnerability in **all versions** of the BioFlo 320 bioreactor that could let a remote attacker with network access take full control of the system’s user interface and associated functions and data. The issue, tracked as `CVE-2026-7251` and mapped to `CWE-259`, carries a **CVSS 9.8** rating and stems from a VNC-based remote management component that uses a hard-coded password; CISA also warned that the VNC traffic is not encrypted, increasing risk where remote access is enabled. The BioFlo 320 is used in laboratory and healthcare environments, raising concerns that unauthorized access could allow manipulation of sensitive biochemical processes. Eppendorf released **Version 5.0** to disable the vulnerable remote control protocol and urged administrators to apply the update immediately, while also confirming the affected remote feature was disabled by default and could only be enabled manually at the physical workstation tower. CISA said BIO-ISAC reported the flaw and that it had no evidence of public exploitation at the time of publication; defenders were also advised to verify local role-based protections so only trusted supervisors can change configurations.
Jun 29, 2026
AVEVA disclosed a critical deserialization of untrusted data vulnerability in **Enterprise SCADA** tracked as `CVE-2025-7639`, a remotely exploitable flaw with a **CVSS 4.0 score of 10.0**. The issue allows an authenticated attacker holding the **"DNA Authority - Operator"** privilege to tamper with serialized data and potentially trigger code execution during deserialization under the privileges of the **"DNA Apps"** security group. The vendor addressed the issue in security bulletin **`AVEVA-2026-005`** and advised organizations to apply available patches and hardening measures. Recommended mitigations include restricting operator privileges and validating serialized data inputs, as the flaw affects industrial control and supervisory environments where compromise of SCADA application privileges could materially increase operational risk.
Aug 14, 2026