Thermo Fisher issues patch for Torrent Suite path-traversal flaw

Thermo Fisher has released a fix for a path-traversal vulnerability (CVE-2026-107777) affecting Torrent Suite Software versions 5.18 and earlier. The vendor recommends that all installations be updated to version 5.22 or later to remediate the issue.

The vulnerability permits an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account. CISA's analysis assigns a CVSS v3 score of 6.5 and classifies the flaw under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The advisory notes that the affected product is deployed worldwide in the healthcare and public-health sectors.

CISA advises organizations to minimize network exposure of control-system devices, place them behind firewalls, and isolate them from business networks. When remote access is required, agencies should employ secure methods such as VPNs, ensuring those solutions are kept current. Additional defensive measures include avoiding unsolicited email links and attachments, and following established internal incident-response procedures. Guidance and technical papers are available on the CISA industrial-control-systems webpage.

At the time of the advisory's initial release on Oct. 15 2026, CISA had not received reports of public exploitation of CVE-2026-107777. Entities observing suspicious activity are instructed to report findings to CISA for correlation with other incidents.