Thermo Fisher Patches Genetic Analyzer Flaw That Let DNA Test Files Be Altered Without a Trace

Thermo Fisher Scientific has patched a flaw in its Applied Biosystems Human Identification software that let an attacker quietly change the .fsa and .hid files these instruments produce, before analysis software loaded them, with no built in way to catch the change.

The company published its bulletin on July 31 and says it has no evidence anyone exploited the flaw. CISA followed with its own advisory on August 4. Thermo Fisher rated it 8.2 on its own CVSS v4.0 scale, and an EPSS score of 0.14% suggests exploitation is unlikely soon. The company credits researchers Nathan Adams, Kevin Dyer, and Laura Gaydosh Combs, along with CISA, for finding and coordinating disclosure of the flaw.

The Wall Street Journal reported that Adams, a systems engineer at Forensic Bioinformatics, tested the flaw on a public dataset and made his first successful edit in about 45 minutes, using Anthropic's Claude to help write the code. In a demonstration, Adams merged two DNA profiles into one file that looked untouched since 2015, and the software that would normally flag a modified file said nothing. Adams believes the weakness has existed in these file formats since 1995 and found no way to tell whether older files had already been altered.

An attacker needs access to a lab's servers or workstations, plus real knowledge of DNA testing. This is not something a stranger does over the internet. The real worry is a compromised machine or an insider, in a lab where the point of the file is that people can trust it.

What got fixed
Thermo Fisher's update adds digital signatures so future files can be checked for tampering. Five product lines are covered:

1. 3500/3500xL Series Data Collection Software, 4.0.2 and earlier, fixed in 4.0.3

2. 3730/3730xL Series Data Collection Software, 5.0.2 and earlier, fixed in 5.0.3

3. SeqStudio Genetic Analyzer Data Collection Software, 1.2.5 and earlier, fixed in 1.2.6

4. SeqStudio Flex Series Instrument Software, 1.2.0 and earlier, fixed in 1.2.1 (labs running SAE must load the newest SAE profile through the SAE Admin Console first)

5. GeneMapper ID X Software, 1.7.3 and earlier, fixed in 1.7.4

The software is labeled "For Research Use Only. Not for use in diagnostic procedures," so the direct exposure sits with forensic and research work such as paternity cases, criminal casework, and results that could end up in front of a judge.

The more interesting read from a Medical device perspective is what does not get fixed. Three lines, the 3130 Series, the ABI PRISM 3100/3100 Avant, and the ABI PRISM 310 Data Collection Software, will never be patched because Thermo Fisher has retired them. That is a key postmarket surveillance challenge. An instrument does not stop running just because a vendor stops supporting the software behind it, and any lab still running one of these three lines now owns the full cybersecurity risk with no vendor safety net.

It is therefore important to proactively track vendor end of life dates in your asset inventory before they are announced, not after, and treat any instrument nearing end of support as a patching decision to make now.

What to do next
Find every instance of the five supported product lines and confirm the version each one runs. Apply the recommended vendor update, starting with systems whose output could end up in court or a paternity case. For the three end of life lines, cut off untrusted network access, add manual chain of custody checks, log who touches every output file, and start planning a move to supported software now.

Sources
Thermo Fisher security bulletin
CISA ICSMA-26-216-01
NVD, CVE-2026-17583