Path traversal in Thermo Fisher's Torrent Suite lets authenticated users read server files

MedDevice Cyber Staff · 21 hrs ago · 3 min read · Via CISA ICSMA-26-288-01

CISA published ICSMA-26-288-01 on October 15, naming CVE-2026-107777 in Thermo Fisher's Torrent Suite Software, the control and analysis platform that runs Ion Torrent next generation sequencing instruments in clinical and research genomics labs. The flaw is a path traversal, tracked as CWE-22, that lets an authenticated user escape the directory the application intends and read any file the Torrent Server's web service account can access. CISA scored it 6.5 under CVSS 3.1 and 7.1 under the newer CVSS 4.0 scale. Versions 5.18 and earlier carry the bug; Thermo Fisher fixes it in 5.22. Akanksha Raghvesh and Abhinav Agarwal are credited with the find.

Torrent Suite is not a bedside device. It is the server software a genomics lab uses to queue sequencing runs, pull raw signal data off an Ion Torrent instrument, and hand analysts the variant calls a pathologist or genetic counselor eventually reads. An account with run access does not need admin rights to pull this off. It only needs the ability to feed the application a crafted path and walk out of the directory the developers meant to confine it to. What comes back depends entirely on what the service account itself can read: configuration files with embedded credentials, other patients' sequencing output sitting on the same server, or application logs with usable detail.

Path traversal survives in web applications because input that looks like a filename gets concatenated into a file system call without the "../" sequences stripped or the resulting path checked against an allow list. It is one of the oldest bug classes in the book, which is also why its continued presence in laboratory instrument software is notable. Clinical genomics platforms accumulate third party libraries and custom code over a product lifecycle measured in years, and a traversal check that was never added at the start rarely gets retrofitted until a researcher, or a mandatory disclosure, forces the question.

CISA says it has no report of this vulnerability being exploited in the wild. The advisory recommends the standard network segmentation and firewall placement for sequencing infrastructure alongside the version upgrade, since an attacker still needs some authenticated foothold on the Torrent Server before the traversal does any work. That foothold requirement caps the severity at medium under CVSS 3.1, but it does not erase the exposure for labs running shared or lightly audited service accounts.

Patch to 5.22. Anything less leaves a hole that turns one compromised lab login into a read primitive against whatever the server itself can see.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade Torrent Suite Software to version 5.22 or later, which adds the path validation that CVE-2026-107777 lacks. Until the upgrade runs, restrict Torrent Server access to known lab accounts and keep the system off any network segment reachable from outside the lab. There is no configuration workaround; the fix only exists in the patched release.

Upgrade to Torrent Suite 5.22 or later. This release adds the path validation that CVE-2026-107777 lacks; no earlier version has a workaround.
Audit and tighten service account permissions. Limit what the Torrent Server's web service account can read on disk, so a traversal bug has less to reach even after the patch.
Segment sequencing infrastructure from general lab networks. Keep the Torrent Server reachable only to instruments and authorized workstations, not the broader network.
Review authenticated accounts with run access. Remove shared or stale logins; a traversal bug is only useful to someone who already has a foothold.

For Device ManufacturersFix the class in the product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server side; never leak internal state to the client.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2026-107777 in Thermo Fisher's Torrent Suite Software?

CVE-2026-107777 is a path traversal vulnerability in Thermo Fisher's Torrent Suite Software, the control platform for Ion Torrent sequencing instruments. Disclosed in CISA advisory ICSMA-26-288-01 on October 15, 2026, it lets an authenticated user read any file the Torrent Server's web service account can access. It carries a CVSS 3.1 score of 6.5.

Is there a patch for the Torrent Suite path traversal vulnerability?

Yes. Thermo Fisher fixes CVE-2026-107777 in Torrent Suite Software version 5.22. Versions 5.18 and earlier are affected, and CISA recommends upgrading along with standard network segmentation for sequencing infrastructure.

Who discovered the Thermo Fisher Torrent Suite vulnerability?

Researchers Akanksha Raghvesh and Abhinav Agarwal are credited with reporting the flaw to CISA, which published it as ICSMA-26-288-01 on October 15, 2026, with no evidence of exploitation in the wild.

← Back to Vulnerabilities