CVE-2026-17583: Thermofisher Abi Prism 3100/3100-avant Data Collection Software vulnerability (CVSS 8.4)

Description

The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Thermofisher Abi Prism 3100/3100-avant Data Collection Software≤ 2.0

Thermofisher Abi Prism 310 Data Collection Software≤ 3.1

Thermofisher Applied Biosystems 3130 Series Data Collection Software≤ 4.1

Thermofisher Applied Biosystems 3500/3500xl Series Data Collection Software< 4.0.3

Thermofisher Applied Biosystems 3730/3730xl Series Data Collection Software< 5.0.3

Thermofisher Applied Biosystems Seqstudio Flex Series Instrument Software< 1.2.1

Thermofisher Applied Biosystems Seqstudio Genetic Analyzer Data Collection Software< 1.2.6

Thermofisher Genemapper Id-x< 1.7.4

Remediation

Fixed in

Thermofisher Applied Biosystems 3500/3500xl Series Data Collection Software≥ 4.0.3

Thermofisher Applied Biosystems 3730/3730xl Series Data Collection Software≥ 5.0.3

Thermofisher Applied Biosystems Seqstudio Flex Series Instrument Software≥ 1.2.1

Thermofisher Applied Biosystems Seqstudio Genetic Analyzer Data Collection Software≥ 1.2.6

Thermofisher Genemapper Id-x≥ 1.7.4

Patch & vendor advisories

References

https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/fsa_hid_bulletin.pdfPatchVendor Advisory
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-216-01PatchThird Party AdvisoryUS Government Resource
https://www.cve.org/CVERecord?id=CVE-2026-17583Third Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2026-17583 being actively exploited?

CVE-2026-17583 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.14%.

How severe is CVE-2026-17583?

CVE-2026-17583 has a CVSS 3.1 base score of 8.4, rated high. EPSS estimates a 0.14% probability of exploitation.

Which products are affected by CVE-2026-17583?

Affected products include Thermofisher Abi Prism 3100/3100-avant Data Collection Software, Thermofisher Abi Prism 310 Data Collection Software, Thermofisher Applied Biosystems 3130 Series Data Collection Software, Thermofisher Applied Biosystems 3500/3500xl Series Data Collection Software, Thermofisher Applied Biosystems 3730/3730xl Series Data Collection Software, and 3 more.

How do I fix CVE-2026-17583?

Upgrade affected software to a fixed version, for example Thermofisher Applied Biosystems 3500/3500xl Series Data Collection Software 4.0.3, Thermofisher Applied Biosystems 3730/3730xl Series Data Collection Software 5.0.3, Thermofisher Applied Biosystems Seqstudio Flex Series Instrument Software 1.2.1 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-17583 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo