Thermo Fisher Patches Flaw That Let Forensic DNA Files Be Tampered With Undetected

Thermo Fisher Scientific has fixed a vulnerability in a number of human identification programs in its Applied Biosystems line. According to a security bulletin dated July 31, the flaw made it possible to alter data files before analytical software loaded them — and edits to output files in the .fsa and .hid formats turned out to be “nearly undetectable” if lab control procedures were bypassed.

The issue was assigned the identifier CVE-2026-17583 and a High rating — 8.2 on the CVSS v4.0 scale. The company credits the discovery and coordinated disclosure to researchers Nathan Adams, Kevin Dyer and Laura Gahdosh Combs, working together with the U.S. agency CISA.

What exactly was fixed

The updates add digital signatures that will henceforth make it possible to verify that a data file has not been altered. They were rolled out to five supported product lines, including the software for the 3500/3500xL series instruments (fixed in 4.0.3), 3730/3730xL (5.0.3), SeqStudio Genetic Analyzer (1.2.6), SeqStudio Flex (1.2.1) and GeneMapper ID-X (v1.7.4). Three lines that were retired long ago, however — the 3130 Series, the ABI PRISM 3100/3100-Avant and the ABI PRISM 310 — will not see any updates: they have been deemed to have reached end of life.

For those who cannot install the patches, the company recommends organizational measures: controlling how files are moved around, storing them on encrypted and password-protected media, restricting access and privileges, and connecting only to trusted networks.

A demonstration with the help of AI

One telling detail was reported by The Wall Street Journal. Systems engineer Nathan Adams of Forensic Bioinformatics tested the vulnerability on a publicly available data set, and his first successful modification of a file using Anthropic's Claude took him about 45 minutes. In the example demonstrated to the outlet, his code merged the scans of two different DNA profiles into a single file that appeared unchanged since 2015 and raised no warnings in widely used analytical software.

To carry out an attack, the researchers say, one needs local or remote access to the lab's servers and an understanding of how DNA testing works. Thermo Fisher itself stated that it is not aware of any cases in which the vulnerability has been exploited.

Open questions

The bulletin stipulates that the signatures help verify file integrity “going forward,” but it does not clarify whether records created before the update can be checked after the fact. The researchers suggest that the vulnerability has been present in the digital files of forensic instruments since as far back as 1995, and they acknowledge that they have not yet found a way to detect earlier tampering. What is at issue is specifically the digital records of analysis results, not the physical DNA samples themselves. As of August 3, The Hacker News had found neither a standalone CVE card in the NVD and CVE.org databases nor any mention of the entry in Thermo Fisher's own public index of bulletins.

Source: The Hacker News