BIO-ISAC Announces Coordinated Disclosure of Critical Vulnerability Affecting Laboratory Bioreactor Systems

FOR IMMEDIATE RELEASE

BIO-ISAC Announces Coordinated Disclosure of Critical Vulnerability Affecting Laboratory Bioreactor Systems

Disclosure Highlights Broader Need to Secure Remote Access Features Across Scientific and Industrial Equipment

The Bioeconomy Information Sharing and Analysis Center (BIO-ISAC) today announced the coordinated disclosure of a critical cybersecurity vulnerability affecting the Eppendorf BioFlo 320 bioreactor system. The vulnerability has been assigned CVE-2026-7251 by CISA.

The vulnerability involves a hard-coded password associated with a Virtual Network Computing (VNC) remote access capability. If remote access had been enabled and the device was reachable over a network, an attacker could potentially gain full access to the system’s user interface and control functions. CISA assigned the vulnerability a CVSS v3.1 score of 9.8 (Critical).

While this vulnerability affects a specific product, it also reflects a broader cybersecurity challenge facing connected laboratory, healthcare, industrial, and operational technology environments. Remote administration capabilities are commonly included in many classes of equipment to support maintenance, monitoring, and operational efficiency. As scientific and laboratory systems become increasingly connected, securing these capabilities becomes increasingly important.

“This discovery reinforces the importance of evaluating how remote access technologies are implemented and managed across laboratory environments,” said Whitney Zatzkin, Director of BIO-ISAC. “The issue identified here is representative of broader challenges that exist across many categories of connected operational and scientific equipment.”

BIO-ISAC appreciates the collaborative and professional engagement of Eppendorf throughout the coordinated disclosure process.

According to the advisory, VNC functionality was disabled by default on affected systems and could only be enabled locally on the device. Eppendorf has since released a software update that permanently removes the VNC capability from the controller and has updated documentation to remove related configuration guidance.

BIO-ISAC also recognizes CISA for its coordination and support in the responsible disclosure process, as well as the broader cybersecurity community that continues to advance protections for critical scientific and healthcare infrastructure.

“This coordinated disclosure demonstrates how industry, government, researchers, and vendors can work together constructively to reduce risk and improve security outcomes,” said Whitney Zatzkin. “Responsible disclosure and collaborative remediation efforts strengthen resilience not only for individual products, but for the broader bioeconomy ecosystem.”

Modern laboratory environments increasingly blend scientific operations with information technology and operational technology systems. BIO-ISAC encourages organizations operating laboratory and bioprocessing equipment to review remote access configurations, minimize unnecessary internet exposure, segment operational systems where possible, and apply vendor updates in accordance with security guidance.

CISA additionally recommends minimizing network exposure for control system devices and using secure remote access methods when remote connectivity is required.

BIO-ISAC remains committed to strengthening cybersecurity collaboration across the bioeconomy sector and advancing awareness of cyber risks affecting laboratory and scientific infrastructure.

Additional information is available through the CISA ICS Medical Advisory ICSMA-26-146-01 and the associated CVE record.

About BIO-ISAC

The Bioeconomy Information Sharing and Analysis Center (BIO-ISAC, isac.bio) supports the security and resilience of the global bioeconomy through collaboration, information sharing, and coordinated defense initiatives involving industry, academia, government, and the research community. If you or your organization require assistance, please email help@isac.bio.