CISA 2026-10-15

Thermo Fisher Torrent Suite Software

CVE-2026-107777

Machine-generated analysis · WAYSCloud LLM

Thermo Fisher Torrent Suite Software versions up to 5.18 are vulnerable to a path-traversal flaw that allows an authenticated attacker to read arbitrary files.

Context

Thermo Fisher Torrent Suite Software (versions ≤ 5.18) is the affected product. The advisory states the software contains an improper limitation of a pathname (CWE-22) that permits an authenticated attacker to read arbitrary files on the Torrent Server via the web service account. Thermo Fisher has released a fix and recommends upgrading to version 5.22 or later. The product is deployed worldwide in healthcare and public-health sectors.

Operator considerations

Check: Verify the installed Torrent Suite Software version and confirm whether it is 5.18 or earlier.
Isolate: Limit network access to the Torrent Server to trusted hosts and segment it from untrusted networks.
Patch: Apply Thermo Fisher’s update to version 5.22 or later as soon as possible.
Log: Monitor web service account file-access logs for unexpected reads of sensitive files.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server.

The following versions of Thermo Fisher Torrent Suite Software are affected:

Torrent Suite Software

Read the full advisory on CISA →