LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

DNA analyzer output could be tampered with, and the software would not notice

MedDevice Cyber Staff · Aug 4 · 3 min read · Via CISA

Researchers merged two DNA profiles into one output file and the analysis software raised no warning. That is the proof of concept behind ICSMA-26-216-01, and it should stop you.

Thermo Fisher Applied Biosystems genetic analyzers, the 3500, 3730, SeqStudio and GeneMapper ID-X lines, ship data-collection software with CVE-2026-17583: missing integrity checking on the .fsa and .hid output files, base score 8.4. An attacker with lab-server access could alter results in a way that is nearly undetectable. These instruments produce forensic and clinical evidence, and an output file you cannot trust is worse than one you cannot read, because someone will act on it. Nathan Adams of Forensic Bioinformatics and colleagues reported it.

Thermo Fisher shipped fixed software, though three end-of-life products stay unpatched. Sign the file, verify the signature, refuse the tampered one. Integrity checking is not optional on an instrument whose results end up in a courtroom.

Remediation Desk

The data-collection software for Applied Biosystems analyzers did not verify the integrity of its own output, so a tampered file passed as genuine. Update per ICSMA-26-216-01 and add integrity verification to any workflow where analyzer output feeds a clinical or forensic decision.

Apply the vendor update. Move to the fixed software version named in ICSMA-26-216-01 across every analyzer workstation.
Sign or hash output files. Where results carry clinical or legal weight, attach a cryptographic signature or hash at creation and verify it before anyone acts on the data.
Restrict write access to result stores. Limit who and what can modify output files, and log every change so a silent merge like the proof of concept cannot happen unseen.

Sources

CISA ↗

Questions & Answers

What does CVE-2026-17583 affect?

Data-collection software for Applied Biosystems genetic analyzers. It did not verify the integrity of its own output files, so results could be altered without the software noticing.

Why is a missing integrity check a safety issue and not just a data issue?

These analyzers produce results that clinicians and labs rely on. If output can be changed silently, a wrong result can flow downstream into a decision, which is why CISA treated it as high severity in ICSMA-26-216-01.

What should labs do?

Apply the vendor update that adds integrity checking, and in the meantime protect the systems that store and move the output files so they cannot be tampered with.

← Back to Vulnerabilities