CVE-2026-17583 — Thermo Fisher Applied Biosystems genetic analyzers write DNA result files with no integrity checking, so results can be altered after the run and no vendor fix is offered

CISA published ICS medical advisory ICSMA-26-216-01 on 2026-08-04, covering CVE-2026-17583 in Thermo Fisher Applied Biosystems genetic analyzers. The defect is a missing integrity check: the .fsa and .hid files these instruments produce can be edited after they are written, and CISA states that successful exploitation could allow an attacker to modify those output files, tampering with DNA data and resulting in inaccurate test results (CISA, 2026-08-04). The advisory carries a CVSS 3.1 base score of 8.4 with a local attack vector, requiring no privileges and no user interaction once the attacker is on the data-collection workstation. The affected list is long and spans generations of hardware, from the current SeqStudio and 3500 series back to the ABI PRISM 310, and CISA names no vendor patch — its recommendations are minimising exposure and defence in depth.

The reason this belongs in a European public-sector brief despite a local-only vector is who runs these instruments. These are the capillary-electrophoresis platforms used by forensic-science institutes serving police and judicial processes, and by clinical and public-health genomics laboratories. The impact class is unusual for this brief: not confidentiality, not availability, but integrity of a result that a court or a clinician will rely on. A tampered .fsa file does not announce itself as an incident — it produces a wrong answer that everything downstream treats as correct, and the instrument software offers no way to detect that the file changed after the run that produced it.

The attack precondition is access to the data-collection workstation or its file store, which places this firmly in the post-compromise and insider space rather than the remote-exploitation space. That is also why the usual triage instinct — low CVSS vector, no exploitation reported, wait for the patch — reaches the wrong answer here. There is no patch to wait for, and the control that closes the gap is architectural rather than a software update.

Detection concepts, telemetry class first. File-integrity monitoring on the .fsa and .hid output directories is the direct signal, and the specific event worth alerting on is a write or rename to a result file after the run that generated it has completed — a legitimate instrument run creates its outputs once. Correlate that with interactive logon events and removable-media events on the data-collection workstation, since the vector requires someone or something operating on that host.

Triage: laboratory information systems, backup agents and analysis software legitimately read these files constantly, and reanalysis workflows may write new derived files. The discriminator is modification in place of an existing result file versus creation of a new one, and whether the writing process is the instrument's own data-collection software during an active run.