Thermo Fisher patches DNA analysis flaw that could let evidence files be quietly altered

Key points

• Thermo Fisher Scientific published a security advisory on July 31 warning of a flaw in Applied Biosystems human identification software.
• The bug, tracked as CVE-2026-17583, could allow tampering with .fsa and .hid data files before analysis software loads them.
• The vendor says the changes could be "nearly undetectable" if a lab's own controls are bypassed.
• Human identification software is widely used in forensic labs to process DNA evidence, including in criminal cases.
• No exploitation in the wild has been reported.

Thermo Fisher Scientific has fixed a flaw in some of its DNA analysis software that could let someone edit forensic data files in a way that is very hard to spot.

The company sells Applied Biosystems software used by forensic laboratories, the labs that process DNA samples from crime scenes, paternity tests and missing persons cases. The bug, first reported by The Hacker News, affects the files those labs work with every day.

What exactly is the flaw?

It is a weakness in how the software handles its own data files. According to Thermo Fisher's July 31 bulletin, an attacker who already had access to a lab's systems could change the contents of .fsa and .hid files, the raw output from DNA sequencing machines, before the analysis software opens them. The edits could be made in a way that the software would not flag as suspicious.

Think of it as a document being swapped out on a desk while the analyst is fetching coffee. The paperwork looks right. The signature at the bottom still matches. But the numbers inside have shifted.

Thermo Fisher tracks the issue as CVE-2026-17583.

Could this be used to frame someone?

In theory, yes, though it is not a click-and-go attack. Someone would first need to get onto the lab's network or the machine handling the files, past the physical and digital controls forensic labs already run. That is a high bar. But the reason this bug matters more than a typical file-format bug is the setting: DNA evidence can put people in prison.

A quiet edit to a raw data file, made before a scientist even loads it, is a very different problem from a corrupted spreadsheet. It is closer, in web-security terms, to a parameter-tampering bug on a form that decides someone's mortgage: the input looks legitimate to the system reading it, so nothing downstream questions it.

What should labs do now?

Install the patched version of the affected Applied Biosystems software as soon as their validation process allows. Forensic tools cannot usually be updated on a whim, because labs have to revalidate the software against known samples before using it on real casework, so the practical timeline will be weeks in some places, not hours.

In the meantime, Thermo Fisher points labs at their existing controls: restricting who can touch raw data files, keeping analysis workstations off the general office network, and logging file access. These are the same controls that would stop an insider swapping a sample tube, applied to the digital side of the workflow.

Should ordinary people worry?

Not in a day-to-day sense. This is not a bug that reaches your phone or your bank. There is no evidence anyone has actually used it. The reason it is worth paying attention to is narrower: it is a reminder that scientific instruments and the software around them are now part of the security story, and the files they produce can be targets in their own right.

Defence lawyers and prosecutors, on the other hand, will likely want to know which version of the software processed any DNA evidence in cases currently being argued.