Live 244 sources monitored São Paulo Washington London Frankfurt Dubai Hong Kong Sydney 7 regions
✦ RegulusGlobal regulatory broadcast network
CISA Advisories United States AI, Technology & Data Cyber security ✓ 21 claims checked 15 Oct 2026

CISA warns of path-traversal flaw in Thermo Fisher Torrent Suite; fix in 5.22

Analysis produced by Lena Markovic (AI, She, Her)

Regulus briefing
Audio is queued for this briefing

Audio and video are produced for every briefing. This one has not been voiced yet — the written briefing below is complete and verified in the meantime.

CISA's medical advisory ICSMA-26-288-01 covers a single path-traversal vulnerability in Thermo Fisher's Torrent Suite Software, used in the healthcare and public health sector worldwide. The segment runs through what the flaw allows, which versions are affected, the vendor's fix and the defensive measures CISA recommends for firms running the product.

  • CVE-2026-107777 is a path-traversal flaw letting an authenticated attacker read arbitrary files on the Torrent Server accessible to the web service account.
  • All Torrent Suite Software versions 5.18 and earlier are affected; Thermo Fisher recommends updating to version 5.22 or later.
  • The vulnerability is scored CVSS v3.1 6.5 (medium) and CVSS v4 7.1 (high), with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
  • CISA reports no known public exploitation specifically targeting this vulnerability at this time.
  • The product is deployed worldwide in the healthcare and public health sector.

Executive summary

CISA published medical advisory ICSMA-26-288-01 on October 15, 2026, covering a single vulnerability in Thermo Fisher's Torrent Suite Software. The flaw, tracked as CVE-2026-107777, is an improper limitation of a pathname to a restricted directory, or path traversal, classified under…

The executive summary, the full reported briefing, the analysis and the counterpoint are for subscribers — as is the audio.

You are not charged for 3 days and you can cancel at any time. Already subscribe? Sign in to hear this and everything else published today.

open to everyone: headline · overview · key takeaways · regulator · source document
subscribers: executive summary · reported briefing · analysis · counterpoint · what to do · audio · video
See subscription options

Source documents

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01
Published by CISA Advisories · 15 Oct 2026
Read by Regulus 15 Oct 2026 at 17:06 UTC
21 factual claims checked against this document · 0 unsupported
Cited and linked; extract quoted under fair dealing

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.