LIVE FEED
A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.
Saturday, October 31, 2026 Issue #499  ·  Est. 2025
Independent brief for device makers
Manufacturers // Thermo Fisher Scientific

Thermo Fisher Scientific

Thermo Fisher Scientific in MedDevice Cyber coverage: 7 stories, 16 products named, 5 CVEs, and the company's own disclosures.

Public disclosure program
Follow Thermo Fisher ScientificClaim this page
Stories
7
Products named
16
Product CVEs
5
Responses on record
0
Latest story
Oct 15, 2026

Coverage

7 stories
01
Vulnerability

Path traversal in Thermo Fisher's Torrent Suite lets authenticated users read server files

CVE-2026-107777, disclosed in CISA advisory ICSMA-26-288-01 on October 15, lets an authenticated user on Thermo Fisher's Torrent Suite genomic sequencing software read any file the web service account can reach. Versions 5.18 and earlier are affected; 5.22 fixes it.

CISAOct 153 min read
02
Vulnerability

Thermo Fisher updates Ion Torrent Genexus software after review finds unauthorized settings changes

Thermo Fisher Scientific's August 13, 2026 bulletin says flaws in Ion Torrent Genexus Dx, Genexus and Genexus Assay Development software could let an unauthorized user change settings or workflow functions. Updates are out; CVE IDs are pending.

Thermo Fisher ScientificAug 133 min read
03
Vulnerability

DNA analyzer output could be tampered with, and the software would not notice

ICSMA-26-216-01: data-collection software for Applied Biosystems genetic analyzers lacked integrity checking on its output files. A proof of concept merged two DNA profiles without tripping any warning.

CISAAug 43 min read
04
Vulnerability

Thermo Fisher Torrent Suite Dx flaw CVE-2026-41085 lets limited users gain administrator access

Thermo Fisher Scientific's May 15, 2026 bulletin rates CVE-2026-41085 in Torrent Suite Dx software 5.14.2 and earlier critical: a limited authenticated user can gain administrator-level access. A security update is available for 5.14.2.

Thermo Fisher ScientificMay 152 min read
05
Vulnerability

Thermo Fisher ePort software up to 3.0.0 carries improper access control flaw CVE-2025-32992

Thermo Fisher Scientific listed a security bulletin for Thermo Scientific ePort software on August 18, 2025. Public CVE records tie it to CVE-2025-32992, an improper access control flaw in ePort up to 3.0.0.

Thermo Fisher ScientificAug 182 min read
06
Vulnerability

Thermo Fisher posts bulletin on Kubernetes Ingress NGINX Controller in Thermo Scientific software

Thermo Fisher Scientific listed a security bulletin on May 14, 2025 for Thermo Scientific software that uses the Kubernetes Ingress NGINX Controller, last updated August 5, 2025.

Thermo Fisher ScientificMay 142 min read
07
Vulnerability

Thermo Fisher Xcalibur and Foundation driver packages allow local privilege escalation

Thermo Fisher Scientific released a bulletin and patch on January 22, 2025 for CVE-2024-55957, a local privilege escalation in driver packages of Xcalibur before 4.7 SP1 and Foundation Instrument Control Software before 3.1 SP10.

Thermo Fisher ScientificJan 223 min read

Products in our coverage

Products and threat intel

1

Thermo Fisher Scientific products with the device attributes their own public documentation states, and the advisories in our coverage that share those attributes.

ProductDevice typeAttributesMatched advisories
Applied Biosystems TaqPath COVID-19 Diagnostic PCR KitRespiratory Specimen Nucleic Acid Sars-Cov-2 Test30

CVEs in coverage of Thermo Fisher Scientific products

CVE-2024-55957 CVE-2025-32992 CVE-2026-107777 CVE-2026-17583 CVE-2026-41085
← All manufacturers