CISA has disclosed a high-severity vulnerability in multiple Thermo Fisher Applied Biosystems genetic analyzer software products that could allow attackers to edit .fsa and .hid output files, altering DNA data and producing inaccurate test results. The advisory, published August 4, assigns the issue CVE-2026-17583 and a CVSS 3.1 score of 8.4, with a high-severity rating. CISA’s advisory identifies healthcare and public health as affected critical-infrastructure sectors and says the products are deployed worldwide.
The vulnerability involves the ability to edit files generated by the instruments. An attacker could tamper with the files before or during analysis, altering DNA data and resulting in inaccurate DNA test outcomes. The advisory characterizes the issue as not remotely exploitable.
CISA’s scoring vector indicates that exploitation requires local access but does not require privileges or user interaction. The impact ratings mark confidentiality, integrity and availability as high under CVSS 3.1. CISA also lists a CVSS 4.0 score of 8.2, with high impact to integrity and no impact to confidentiality or availability under that scoring system. The vulnerability was reported by Nathaniel Adams, Laura Gaydosh-Combs and Kevin Dyer, according to the advisory.
Affected products include Data Collection Software for the Applied Biosystems 3500/3500xL, 3730/3730xL and 3130 series, along with software for SeqStudio Genetic Analyzer and SeqStudio Flex Series instruments. GeneMapper ID-X Software is also listed, as are ABI PRISM 3100, 3100-Avant and 310 Data Collection Software. CISA identifies the Thermo Fisher Applied Biosystems 3500/3500xL Data Collection Software as a known-affected product status in the advisory.
Thermo Fisher has developed security updates that add digital signatures to the instrument software. CISA says the signatures provide an additional layer of protection and help users verify that data files have not been modified. The listed fixes are version 4.0.3 for 3500/3500xL Data Collection Software, 5.0.3 for 3730/3730xL Data Collection Software, 1.2.6 for SeqStudio Genetic Analyzer Data Collection Software, 1.2.1 for SeqStudio Flex Series Instrument Software and 1.7.4 for GeneMapper ID-X Software. The advisory provides the vendor download links and version details.
The advisory lists the Applied Biosystems 3130 Series, ABI PRISM 3100/3100-Avant and ABI PRISM 310 Data Collection Software as end-of-life products and says no update is provided for them. It also directs readers to a Thermo Fisher security bulletin for additional information.
For users who cannot immediately implement all applicable security updates, Thermo Fisher recommends maintaining a secure chain of custody for files produced by the instrumentation, storing those files on encrypted and password-protected media, restricting access to authorized personnel and applying least-privilege permissions on systems running the instrumentation or related analysis software. It also recommends firewall rules and network access control lists that limit internet connectivity to trusted sources. CISA separately advises minimizing network exposure for control-system devices and using secure methods for necessary remote access.
CISA said no known public exploitation specifically targeting CVE-2026-17583 had been reported to the agency at the time of publication. Organizations observing suspected malicious activity are advised to follow internal procedures and report findings to CISA.