CISA Warns of Path Traversal Vulnerability in Thermo Fisher Torrent Suite Software
CISA has issued an advisory for Thermo Fisher Torrent Suite Software versions <=5.18, detailing CVE-2026-107777, a path traversal vulnerability that allows authenticated attackers to read arbitrary files.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an advisory detailing a critical path traversal vulnerability affecting Thermo Fisher Torrent Suite Software. Identified as CVE-2026-107777, this flaw impacts versions of the software up to and including 5.18.
The vulnerability, classified under CWE-22, allows an authenticated attacker with access to the Torrent Server to read arbitrary files that are accessible to the web service account. This could potentially expose sensitive system information or configuration details, depending on the permissions of the service account.
The CVSS v3.1 score for this vulnerability is rated at 6.5 (MEDIUM), with a CVSS 4.0 score of 7.1 (HIGH). The vector string for CVSS 3.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) indicates that exploitation is possible over the network with low complexity and requires low privileges, with no user interaction needed, and results in a high confidentiality impact.
Thermo Fisher Scientific has addressed this vulnerability by releasing version 5.22 and later of the Torrent Suite Software. The company recommends that all users update to these patched versions to mitigate the risk of exploitation.
CISA is urging organizations within the Healthcare and Public Health critical infrastructure sectors, where this software is deployed worldwide, to take immediate defensive measures. These include minimizing network exposure for all control system devices, ensuring they are not accessible from the internet, and locating control system networks behind firewalls and isolating them from business networks.
While no known public exploitation of this specific vulnerability has been reported to CISA at this time, the potential impact of unauthorized file access necessitates prompt remediation. The advisory also reminds organizations to perform proper impact analysis and risk assessment before deploying any defensive measures.
This advisory was reported to CISA by researchers Akanksha Raghvesh and Abhinav Agarwal. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of Industrial Control Systems (ICS) assets and to report any suspected malicious activity.