Vulnerability

Thermo Fisher updates Ion Torrent Genexus software after review finds unauthorized settings changes

MedDevice Cyber Staff · Aug 13 · 3 min read · Via Thermo Fisher Genexus security bulletin

Thermo Fisher Scientific published a bulletin on August 13, 2026 on flaws in its Ion Torrent Genexus software. Affected are Genexus Dx software 6.8.2.1, 6.8.4.0 and earlier, Genexus software 6.8.4.0, 7.0.2 and earlier, and Genexus Assay Development software 6.8.4.0, 7.0.2 and earlier.

An internal security review found the flaws, which could let an unauthorized user change certain settings or workflow functions. Thermo Fisher reports no evidence of exploitation and has released updates. CVE IDs were pending, and the bulletin was last updated on October 9, 2026.

Thermo Fisher also advises restricting access and keeping instruments off the public Internet. A quietly changed workflow setting is hard to spot after the fact, so log configuration changes on these systems.

Are you a representative of Thermo Fisher Scientific? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Genexus Dx, Genexus and Genexus Assay Development software at the listed versions let an unauthorized user change settings or workflow functions. Thermo Fisher has released updates. Install them, restrict access and keep instruments off the public Internet.

Install the updates. Apply Thermo Fisher's released updates to all affected Genexus Dx, Genexus and Assay Development installs.
Restrict access. Limit network and user access to Genexus instruments to the people and hosts that need it.
Keep instruments off the Internet. Confirm no Genexus system is reachable from the public Internet.
Log configuration changes. Review settings and workflow change records on these systems regularly.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Role-based access

Ion Torrent Genexus Dx software

User accounts

Ion Torrent Genexus software

User accounts

Ion Torrent Genexus Assay Development software

User accounts

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Questions & Answers

Which Ion Torrent Genexus software versions are affected by the Thermo Fisher bulletin?

Thermo Fisher's August 13, 2026 bulletin lists Ion Torrent Genexus Dx software 6.8.2.1, 6.8.4.0 and earlier, and Genexus and Genexus Assay Development software 6.8.4.0, 7.0.2 and earlier.

Has the Genexus software vulnerability been exploited?

Thermo Fisher Scientific reports no evidence of exploitation of the Ion Torrent Genexus flaws in its August 13, 2026 bulletin, and has released updates.

← Back to Vulnerabilities