Path Traversal (CVE‑2026‑107777) in Thermo Fisher Torrent Suite Software Allows Authenticated File Read
What It Is – Thermo Fisher’s Torrent Suite Software ≤ 5.18 contains an improper‑limitation‑of‑a‑pathname (CWE‑22) that lets an authenticated attacker read arbitrary files accessible to the web‑service account.
Exploitability – The vulnerability is publicly disclosed (CVE‑2026‑107777) with a CVSS v3 base score of 6.5 (Medium). No public exploit code has been released, but the attack requires only valid credentials to the web interface.
Affected Products – Thermo Fisher – Torrent Suite Software version 5.18 and earlier (used in genomic sequencing and other laboratory workflows).
Why It Matters for Trust & Control Assurance
- Third‑party patch management – Demonstrating that all vendor‑supplied components are up‑to‑date is a core control evidence point for auditors and enterprise buyers.
- File‑access segregation & logging – Controls that restrict web‑service accounts to least‑privilege directories and retain immutable access logs provide a defensible audit trail if a breach is alleged.
- Continuous assurance – Automated evidence of patch status and file‑access monitoring satisfies multiple framework objectives (e.g., NIST CSF Identify and Protect) with a single control implementation.
Recommended Actions
- Upgrade Torrent Suite to version 5.22 or later per Thermo Fisher’s security bulletin.
- Verify that the web‑service account is limited to the minimum required filesystem scope; enforce directory‑level ACLs.
- Enable comprehensive logging of file‑read operations and integrate logs into a SIEM for continuous monitoring.
- Record the patch status in your third‑party risk inventory and schedule regular verification.
Source: CISA Advisory – IC SMA‑26‑288‑01