Critical DNA Test Software Flaw Lets Attackers Alter Analysis Data

Key Takeaways

• A critical vulnerability (CVE-2026-17583) has been discovered in Thermo Fisher Scientific’s Applied Biosystems Human Identification (HID) software.
• The flaw allows attackers to subtly alter forensic DNA analysis files (.fsa and .hid) before processing, making changes almost impossible to detect.
• The vulnerability impacts various data collection and analysis software versions used in forensic laboratories worldwide.
• Thermo Fisher has released patches for most affected products; however, older, end-of-life systems will not receive updates.
• The issue carries a high CVSS v4.0 score of 8.2, raising serious concerns about the integrity of forensic evidence.

Thermo Fisher Scientific has issued a disclosure regarding a severe security flaw impacting multiple software products within its Applied Biosystems Human Identification (HID) suite. This vulnerability, identified as CVE-2026-17583 and assigned a CVSS v4.0 score of 8.2, presents a critical risk: it could enable malicious actors to modify forensic DNA analysis data files with near-perfect stealth before they are processed by laboratory software. The details of this flaw were made public on July 31, 2026.

The core of the issue lies within the .fsa and .hid file types, which are proprietary data formats generated by Applied Biosystems Human Identification instruments. These instruments and their associated software are foundational tools in forensic laboratories globally, integral to DNA profiling and identification processes.

According to Thermo Fisher’s advisory, if an attacker manages to bypass existing laboratory security protocols, they could manipulate these critical output files. The concerning aspect is that such alterations would be virtually imperceptible during standard review procedures within the analysis software.

Given that .fsa and .hid files often form the basis of evidence in criminal investigations, paternity tests, and other identity-related cases, the potential for undetected data tampering introduces profound concerns regarding the reliability of forensic conclusions and the integrity of the chain of custody.

DNA Test Software Vulnerability Details

The vulnerability spans several generations of Applied Biosystems data collection and analysis software. Affected versions include:

• 3500/3500xL Series Data Collection Software (version 4.0.2 and earlier)
• 3730/3730xL Series Data Collection Software (version 5.0.2 and earlier)
• SeqStudio Genetic Analyzer Data Collection Software (version 1.2.5 and earlier)
• SeqStudio Flex Series Instrument Software (version 1.2.0 and earlier)
• GeneMapper ID-X Software (version 1.7.3 and earlier)

Thermo Fisher has released patched versions to address this vulnerability. These updates, available for immediate deployment, are 4.0.3, 5.0.3, 1.2.6, 1.2.1, and 1.7.4, respectively. A key enhancement in these new versions is the implementation of digital signatures, which empower laboratories to verify that a data file has not been tampered with since its generation by the instrument. Thermo Fisher has released patched versions detailing these updates.

Users operating the SeqStudio Flex system with the Secure Analytics Environment (SAE) enabled must take an additional preliminary step. Before applying the relevant software update, they are required to install the latest SAE profile via the SAE Admin Console.

It is important to note that certain older platforms, specifically the 3130 Series, ABI PRISM 3100/3100-Avant, and ABI PRISM 310 Data Collection Software, have reached their end-of-life status. Consequently, these systems will not receive security patches, leaving them perpetually exposed to this vulnerability unless they are decommissioned or isolated from critical networks.

For organizations unable to immediately deploy the recommended updates, or for those utilizing third-party analysis platforms, Thermo Fisher advises implementing a series of compensating controls. These measures include rigorously maintaining a secure chain of custody for all files throughout the analysis workflow, storing generated data on encrypted and password-protected storage media (such as encrypted USB drives or hard drives), and restricting file access to only authorized personnel. Furthermore, applying least-privilege permissions on systems running HID instrumentation and utilizing firewall rules or network access control lists to limit internet connectivity to trusted sources are strongly recommended.

Thermo Fisher acknowledged the contributions of researchers Nathan Adams, Kevin Dyer, and Laura Gaydosh Combs, alongside the Cybersecurity and Infrastructure Security Agency (CISA), for their role in identifying the vulnerability and coordinating its responsible disclosure.

What You Should Do

• Apply Patches Immediately: Organizations using affected Thermo Fisher Scientific Applied Biosystems HID software should prioritize applying the latest security updates (versions 4.0.3, 5.0.3, 1.2.6, 1.2.1, and 1.7.4) as soon as practically possible.
• Update SAE Profiles: SeqStudio Flex system users with Secure Analytics Environment (SAE) enabled must install the latest SAE profile via the SAE Admin Console before applying software updates.
• Isolate or Retire End-of-Life Systems: For older, unpatched platforms (3130 Series, ABI PRISM 3100/3100-Avant, ABI PRISM 310), consider isolating them from networks or retiring them from service to prevent exploitation.
• Implement Compensating Controls: If immediate patching is not feasible, enforce strict chain-of-custody protocols for all data files, use encrypted and password-protected storage, implement least-privilege access controls, and restrict network connectivity for HID instrumentation.
• Contact Thermo Fisher: For any questions or assistance regarding the vulnerability and its mitigation, affected organizations should reach out to Thermo Fisher’s product security team.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.