Blog · November 3, 2026
A CISA advisory for sequencing software: what IVD makers should take from it
Naomi Schwartz
The advisory in brief
In October 2026, CISA published medical advisory ICSMA-26-288-01 on Thermo Fisher Torrent Suite Software, server software that runs genomic sequencing workflows. The advisory covers one vulnerability, CVE-2026-107777, which affects versions 5.18 and earlier.
| Detail | Value |
|---|---|
| Weakness | Path traversal (CWE-22) |
| Impact | An authenticated attacker can read any file on the sequencing server that the web service account can access |
| Severity | CVSS v3.1 6.5 (Medium); CVSS v4 7.1 (High) |
| Access needed | Network access and a low-privilege account; no user interaction |
| Exploitation | No public exploitation reported; not on CISA's Known Exploited Vulnerabilities list |
The vendor has released a fix. If you run the affected software, follow the upgrade steps in the CISA advisory.
Why IVD makers should care
Lab instruments are no longer standalone boxes. Many ship with a web server, user accounts and a direct path to patient and genomic data. That's the same attack surface FDA expects you to describe for a cyber device under Section 524B, and it's what QMSR inspectors will trace through your design and CAPA records.
Five lessons
- Threat-model the server, not just the instrument. The vulnerable part here was a web interface, so put the instrument's servers, interfaces and accounts in your threat model.
- "Authenticated" doesn't mean low risk. A stolen or shared lab account is enough for this attack. Limit what each service account can read, and log file access.
- Coordinated disclosure is a requirement. Section 524B requires a plan that includes coordinated vulnerability disclosure. This advisory is what a working CVD program looks like from the outside.
- Your postmarket plan has to cover customer upgrades. Labs run instruments for years. Your postmarket plan should say how you tell customers about a fix and how fast.
- Expect inspectors to ask about it. Under QMSR, a vulnerability report is a quality signal that should flow into complaint handling and CAPA. See what IVD warning letters say about cybersecurity.
FAQ
Is lab instrument software a cyber device under 524B?
If it includes software, can connect to the internet and could be vulnerable to cybersecurity threats, it likely meets the 524B definition when it's part of a device submission. Confirm the scope with your regulatory team.
Does a medium-severity CVE need a field action?
Not by default. Assess exploitability and patient impact under your postmarket plan, then document the decision.
Where can IVD makers get help?
See IVD cybersecurity or talk to a former FDA reviewer.
