Critical DNA Data Tampering Vulnerability in Thermo Fisher Software

Thermo Fisher Scientific disclosed a critical vulnerability, CVE-2026-17583, in its Applied Biosystems human identification software, allowing attackers to alter DNA analysis files (.fsa and .hid) without detection. This flaw has existed since at least 1995 and poses a significant risk to forensic and clinical DNA evidence integrity. Exploitation requires access to laboratory systems and knowledge of DNA workflows. No exploitation in the wild has been reported as of August 2026, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. A patch has been released, introducing digital signatures for new files, but historical data remains vulnerable. The vulnerability was demonstrated using AI to manipulate DNA profiles, raising serious concerns about data authenticity. As of now, there are no public indicators of compromise or proof-of-concept code available.

Key Points: • CVE-2026-17583 allows undetectable tampering of DNA data files in Thermo Fisher software. • The vulnerability has existed since at least 1995 and poses risks to forensic evidence integrity. • No reports of exploitation in the wild have been confirmed as of August 2026.