CVE-2026-107777

Thermo Fisher Torrent Suite Software has a path traversal flaw (CWE-22) that lets an authenticated attacker read arbitrary files on the Torrent Server that the web service account can access. The issue is reachable over the network with low privileges and no user interaction, and the impact is high confidentiality loss on the server with no integrity or availability impact in the CVSS scoring. It affects Torrent Suite Software used with Thermo Fisher Torrent sequencing systems; the supplied data does not name specific version ranges. CVSS 4.0 rates the issue 7.1 (high). It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Apply the vendor fix for Thermo Fisher Torrent Suite as soon as it is published, and until then limit network access to the Torrent Server to trusted lab networks and accounts. Review web-service account privileges and audit access logs for unexpected file reads. Confirm the exact affected builds from the ICS-CERT/vendor advisory rather than guessing versions.