CISA Flags Undetected DNA Tampering in Thermo Fisher Analyzers
Eight instrument lines used in forensic labs shipped without file-integrity verification; three are end-of-life with no patch coming.
TL;DR
CISA disclosed CVE-2026-17583, a missing-integrity-check vulnerability in eight versions of Thermo Fisher Applied Biosystems genetic analyzer software. The .fsa and .hid output files can be modified without detection, DNA test results used in criminal prosecutions and medical diagnoses can be tampered with and no one would know. Thermo Fisher has patched five product lines with digital signatures. Three legacy systems, including the ABI PRISM 310 and 3100 series, are end-of-life and won't receive fixes.
The vulnerability sits at an uncomfortable intersection of cybersecurity and evidentiary chain of custody. Thermo Fisher's Applied Biosystems genetic analyzers are workhorses in forensic DNA typing, they're the instruments that produce the electropherogram files a crime lab analyst reviews before testifying in court. Until last week's patches, those output files carried no cryptographic signature. Anyone with access to the file could modify it, and the software wouldn't flag the change.
CVE-2026-17583 covers eight product lines spanning decades of instrumentation: from the current SeqStudio Flex Series down to the ABI PRISM 310, a capillary electrophoresis instrument first shipped in the late 1990s. The vulnerability is blunt (CWE-353, Missing Support for Integrity Check) and the attack vector is local. An attacker with file-system access modifies the .fsa or .hid output, and the downstream analysis software treats the altered data as authentic.
Thermo Fisher's remediation splits the product line in two. Five current instruments (the 3500/3500xL, 3730/3730xL, SeqStudio, SeqStudio Flex, and GeneMapper ID-X) received patches that implement digital signatures on output files. Three legacy systems didn't: the 3130 Series and the 3100/3100-Avant, plus the ABI PRISM 310. Labs still running these instruments (and plenty of forensic labs do, because validation of a new platform against existing casework protocols takes years) are left with workarounds: encrypted USB drives, access-control policies, and chain-of-custody documentation. Those are process controls, not technical controls. They depend on humans following procedure every time.
The advisory doesn't answer the retroactive question. How long was CVE-2026-17583 exploitable before disclosure, and were any criminal cases or medical decisions influenced by data from unpatched instruments? Thermo Fisher hasn't said, and CISA's "no known public exploitation" language is a statement about what's been reported, not about what's possible.
For the lab director or forensic analyst reading this on Monday: the patch is the first priority on supported instruments. On the EoL hardware, the mitigation is paperwork. Document which cases ran on which instrument and when. If your lab's SOP doesn't already require cryptographic verification of output files (and until this advisory, most didn't) now's the time to write one, even if the instrument itself can't generate the signature yet. The uncomfortable truth is that a defense attorney who understands this advisory has a new question for every DNA analyst who takes the stand.
Published ·Deep Fathom