Path Traversal Flaw in Thermo Fisher Lab Software Exposes Healthcare Data

Healthcare Labs Face Data Exposure Risk

CISA published an advisory for a path traversal vulnerability (CVE-2026-107777, CVSS 6.5) in Thermo Fisher's Torrent Suite Software, a genomic sequencing platform deployed worldwide in healthcare and research labs. An authenticated attacker can exploit the flaw to read arbitrary files accessible to the web service account on the Torrent Server. Thermo Fisher has released version 5.22 to address the issue and urges all users to update immediately.

While this affects specialized lab equipment rather than typical business IT, the pattern matters for SMBs managing vendor software or supporting healthcare clients. Path traversal bugs remain common in web-based appliances and embedded systems, often because vendors treat internal tools as trusted environments. If your organization operates medical devices, lab systems, or any appliance with a web interface, verify that vendors publish security bulletins and that you have a process to track and apply updates. Authenticated access requirements don't eliminate risk - insider threats, credential theft, and lateral movement after initial compromise all create pathways for exploitation. For healthcare providers and labs, this is a compliance concern under HIPAA as well as a patient safety issue if genomic or diagnostic data is exposed.

Read the full CISA advisory

Need help managing vendor security updates, tracking vulnerabilities across your infrastructure, or building a medical device security program? O-Cyrus works with SMBs to establish practical vulnerability management and compliance workflows. Contact us to discuss your environment.