Thermo Fisher Applied Biosystems CVE | Biological Data Integrity
As of: August 3, 2026
A disclosed vulnerability (CVE-2026-17583) affects Thermo Fisher’s Applied Biosystems Human Identification Software.
Severity: High (CVSS v4 8.2)
Researchers found that certain DNA data files could potentially be modified without detection if laboratory security controls are bypassed. Thermo Fisher has released security updates that also add digital signatures to verify file integrity. There are no known cases of exploitation at this time. Three end-of-life product lines will receive no vendor updates.
Thank you to Laura Gaydosh Combs, a forensic scientist and professor at University of New Haven, as well as Nathan Adams and Kevin Dyer for their work discovering and documenting this vulnerability.
BIO-ISAC Recommendation: Apply vendor updates, validate digital signatures where available, and review laboratory data integrity controls.
This disclosure reinforces BIO-ISAC's ongoing work to improve the integrity, authenticity, and provenance of biological data across the bioeconomy. If you or your organization require assistance, please contact help@isac.bio.
Learn more:
Wall Street Journal: https://www.wsj.com/tech/cybersecurity/security-flaw-placed-30-years-of-dna-evidence-at-risk-of-hacking-1932775a
Thermo Fisher Security Bulletin: https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/fsa_hid_bulletin.pdf
HackerNews:
https://thehackernews.com/2026/08/thermo-fisher-patches-flaw-that-could.html
CVE (not populated at the time of posting):