Thermo Fisher Patches DNA File Tampering Flaw
Get the Health newsletter
Daily health & science — research, biotech, public health, the studies worth knowing. Free.
- Thermo Fisher Scientific patched a high-severity flaw (CVE-2026-17583, CVSS 8.2) in Applied Biosystems human identification software that could allow nearly undetectable changes to .fsa and .hid output files before analysis software loads them
- Nathan Adams, a Forensic Bioinformatics systems engineer, used Anthropic's Claude to modify a DNA file in about 45 minutes via a public data set — merging two individual profiles into a new file that appeared untouched since 2015 and raised no warnings in standard analysis software
- Thermo Fisher shipped digital-signature updates for five supported Applied Biosystems product lines: 3500/3500xL (4.0.3), 3730/3730xL (5.0.3), SeqStudio (1.2.6), SeqStudio Flex (1.2.1), and GeneMapper ID-X (v1.7.4)
- Three end-of-life product lines — 3130 Series, ABI PRISM 3100/3100-Avant, and ABI PRISM 310 — will receive no vendor update, leaving those lab installations without a fix
- Thermo Fisher credits researchers Nathan Adams, Kevin Dyer, and Laura Gaydosh Combs, alongside CISA, with identifying the issue and coordinating disclosure, and told The Wall Street Journal it knew of no instances of exploitation
- The vulnerability likely existed in digital files produced by crime-lab machines since 1995, and the researchers told the Journal they found no method to detect tampering that may have already occurred
- As of August 3, 2026, CVE-2026-17583 had no separate detail page on CVE.org or the National Vulnerability Database and was not listed in CISA's Known Exploited Vulnerabilities catalog
Why it matters: Forensic laboratories using Thermo Fisher's Applied Biosystems software face integrity gaps in DNA casework files potentially exploitable since 1995, with three end-of-life product lines receiving no vendor fix and no documented method to retroactively validate whether prior files were altered — a direct concern for criminal cases relying on digital DNA records.
