# CVE-2026-17583 — High-Severity Tampering Flaw in Thermo Fisher Applied Biosystems Forensic DNA Analysis Software

> CVE-2026-17583 (CVSS 8.2, HIGH) is a file integrity vulnerability in Thermo Fisher Scientific's Applied Biosystems Human Identification (HID) software that allows nearly undetectable tampering with forensic DNA evidence files (.fsa and .hid formats). Patches adding digital signatures are available for 5 supported product lines; 3 end-of-life products remain permanently exposed. The vulnerability likely existed since ~1995 with no known exploitation in the wild as of disclosure.

- **Published:** 2026-08-04T00:00:00Z
- **Last reviewed:** 2026-08-04T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1854
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-thermo-fisher-hid-dna-tampering-tl-2026-1854.webp?v=c939fbbc (Threadlinqs threat intel: CVE-2026-17583 Thermo Fisher HID DNA Forgery (TL-2026-1854) — High severity, 8 IOCs, 9 detection rules.)
- **ID:** TL-2026-1854
- **Severity:** HIGH (CVSS 8.2)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 8
- **CVEs:** CVE-2026-17583

## Description

## Overview

CVE-2026-17583 is a high-severity (CVSS 8.2, CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N) file integrity vulnerability affecting Thermo Fisher Scientific's Applied Biosystems Human Identification (HID) software product line — the dominant forensic DNA analysis platform used by crime laboratories across the United States and internationally. The flaw resides in the absence of cryptographic integrity verification between the instrument data collection layer and the analysis software: .fsa (fragment analysis) and .hid (Human IDentification) output files are accepted by analysis software (GeneMapper ID-X, 3500/3500xL Data Collection Software, 3730/3730xL Data Collection Software, SeqStudio) without any check tying the digital record to the producing instrument. An attacker who gains access to a laboratory's systems — locally or remotely — can modify these binary files before they are ingested by analysis software, and the alterations will be virtually impossible to detect through normal forensic review.

## Technical Details: ABIF File Format

Both .fsa and .hid files use the proprietary ABIF (Applied Biosystems Inc. Format) binary container format, the same underlying format as .ab1 sequencing files. An ABIF file consists of three logical sections: (1) a 128-byte header containing the ASCII signature 'ABIF' (0x41424946) at bytes 0-3, a version field (typically 101 for v1.01), a numelements field at bytes 18-21 (SInt32), and a dataoffset field at bytes 22-25 (SInt32) pointing to the directory array; (2) a directory array of 28-byte DirEntry structures — each containing a 4-byte tag name (e.g., 'DATA' for raw fluorescence trace data, 'PLOC' for peak location data, 'APrX1' for analysis parameter XML), a tag number (SInt32), element type code (SInt16), element size (SInt16), number of elements (SInt32), data size (SInt32), and data offset (SInt32) pointing into the data section; and (3) the raw data payload containing tagged items such as fluorescence trace data from up to 12 dye channels (DATA1-DATA12), peak location data (PLOC1-PLOC2), instrument identification (MCHN), sample container identifier (CTID), and analysis parameter XML (APrX1). All integers are big-endian. Critically, there is no embedded digital signature, checksum, or cryptographic hash across the file contents — the file format predates modern integrity requirements, with researchers assessing it has been deployed since approximately 1995.

## Attack Vector

An attacker with file-write access to a laboratory server or workstation can execute a multi-step tampering operation: (1) use valid accounts (T1078) or external remote services (T1133) to gain initial access to the laboratory's IT environment; (2) discover target .fsa and .hid evidence files through file and directory discovery (T1083); (3) copy or read the target files from the local system (T1005); (4) use a hex editor or custom scripting tool — potentially AI-generated — to modify the ABIF binary data structure (T1059.007), specifically: alter raw DATA fluorescence trace values to add or remove allele contributions, modify PLOC peak location entries to change called alleles, rewrite APrX1 analysis parameter XML to alter instrument metadata and sample identification, and adjust file timestamps to masquerade as untouched originals (T1036); (5) optionally clear Windows Event Logs (T1070.001) to cover forensic tracks; and (6) load the tampered file back into GeneMapper ID-X or other analysis software, which will process the modified data without triggering any integrity warning. The tampered file can combine DNA profiles from multiple individuals, fabricate or eliminate a suspect's profile, alter sample attribution, or corrupt evidence rendering it unusable (T1485 — Data Destruction).

Researcher Nathan Adams (Forensic Bioinformatics) demonstrated this attack using Anthropic's Claude AI to write the file modification code in approximately 45 minutes. The demonstration merged capillary electrophoresis scans from two individuals' DNA profiles into a single output file that appeared untouched since 2015 and raised no warnings when loaded into standard forensic analysis software. This highlighted how AI dramatically lowers the technical barrier to crafting such tampering tools.

## Affected Products and Patching

Five currently supported product lines received patches (July 31, 2026) that introduce digital signature verification, allowing laboratories to cryptographically validate that a data file has not been altered since it left the instrument:

- 3500/3500xL Series Data Collection Software (fixed v4.0.3)
- 3730/3730xL Series Data Collection Software (fixed v5.0.3)
- SeqStudio Genetic Analyzer Data Collection Software (fixed v1.2.6)
- SeqStudio Flex Series Instrument Software (fixed v1.2.1)
- GeneMapper ID-X Software (fixed v1.7.4)

SeqStudio Flex users with Secure Analytics Environment (SAE) must install the latest SAE profile via the SAE Admin Console before applying the update.

Three end-of-life products receive no patch and remain permanently exposed: 3130 Series Data Collection Software 4.1 and earlier, ABI PRISM 3100/3100-Avant Data Collection Software 2.0 and earlier, and ABI PRISM 310 Data Collection Software 3.1 and earlier.

## Evidentiary and Legal Implications

The vulnerability creates a critical gap in the forensic evidence chain of custody. Digital DNA evidence files underpin criminal investigations, paternity testing, missing-person identification, and mass-casualty victim identification worldwide. Because the digital signatures operate only on files created after the patch is applied, roughly 30 years of existing digital forensic files cannot be retroactively validated. There is currently no known method to detect tampering in historical case files. This raises significant challenges for evidence admissibility, cold-case reviews, and the integrity of conclusions drawn from legacy digital evidence. Laura Gaydosh Combs (University of New Haven) noted that these data files 'lack the same level of tamper-evident markings that we require for a paper bag.'

## Mitigation and Compensating Controls

For laboratories unable to immediately patch or operating end-of-life instruments, Thermo Fisher recommends: maintaining secure chain-of-custody documentation for all evidence files; storing files on encrypted and password-protected media (encrypted USB drives or hard drives); restricting file access to authorized personnel only with least-privilege permissions on HID instrumentation systems; using firewall rules or network access control lists to limit connectivity to trusted sources; and employing third-party analysis platforms for cross-validation. A longer-term strategy should include replacing end-of-life instruments with supported models that receive integrity updates.

## Disclosure and Status

The vulnerability was identified and disclosed through CISA-coordinated responsible disclosure by researchers Nathan Adams (Forensic Bioinformatics), Kevin Dyer, and Laura Gaydosh Combs (University of New Haven). Thermo Fisher privately acknowledged the report in July 2026, and the security bulletin was published on July 31, 2026. The company stated it has found no evidence of exploitation in the wild as of the disclosure date. The CVE was not yet published on NVD detail pages or listed in CISA's Known Exploited Vulnerabilities (KEV) catalog as of early August 2026. The disclosure has prompted broader scrutiny of cybersecurity practices across the forensic science industry, where no centralized regulator currently oversees laboratory information security, resulting in a patchwork of security measures across over 200 U.S. crime laboratories.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1565 Data Manipulation
- T1036 Masquerading
- T1021 Remote Services
- T1005 Data from Local System
- T1020 Automated Exfiltration
- T1071 Application Layer Protocol
- T1485 Data Destruction

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Unauthorized Modification of Forensic DNA Evidence Files (.fsa/.hid)** (`TL-2026-1854-SPL-002`)

Detects modification of .fsa/.hid forensic DNA evidence files by processes other than authorized Thermo Fisher instrument software (GeneMapper_IDX.exe, 3500_DataCollection.exe, SeqStudio.exe). Per CVE-2026-17583, the core vulnerability is that analysis software accepts modified ABIF files without integrity verification. Modification by any process outside the authorized instrument pipeline indicates data manipulation (T1565.001) — the central attack technique of this CVE.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1565.001, T1485
- **Data sources:** sysmon_file_write, sysmon_file_creation, edr_file_modification_events
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=windows sourcetype="XmlWinEventLog" EventCode=2 (TargetFilename="*.fsa" OR TargetFilename="*.hid")
| eval process_name=mvindex(split(Image,"\\"),-1)
| search process_name!="GeneMapper_IDX.exe" process_name!="3500_DataCollection.exe" process_name!="3730_DataCollection.exe" process_name!="SeqStudio.exe" process_name!="SeqStudioFlex.exe"
| stats values(TargetFilename) as modified_files values(Image) as process_by values(UserID) as users by Computer
| eval file_count=mvcount(modified_files)
| where file_count >= 1
| table Computer process_by modified_files users
| sort - file_count
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(7d)
| where ActionType == "FileModified"
| where FolderPath contains ".fsa" or FolderPath contains ".hid"
| extend ProcessName = tostring(split(FolderPath, "\\")[-1])
| where InitiatingProcessFileName !in~ ("GeneMapper_IDX.exe", "3500_DataCollection.exe", "3730_DataCollection.exe", "SeqStudio.exe", "SeqStudioFlex.exe")
| project Timestamp, DeviceName, FolderPath, InitiatingProcessFileName, InitiatingProcessFolderPath, AccountName, SHA1
| order by Timestamp desc
```

### Sigma

```yaml
title: Unauthorized Process Modified Forensic DNA Evidence File
id: d4e5f6a7-b8c9-0123-defa-234567890123
status: experimental
description: Detects when a process other than authorized Thermo Fisher instrument software modifies a .fsa or .hid forensic DNA evidence file. This is the central exploitation indicator for CVE-2026-17583, where ABIF files lack cryptographic integrity verification and can be tampered with by any process with file-write access.
references:
  - "https://attack.mitre.org/techniques/T1565.001/"
  - "https://nvd.nist.gov/vuln/detail/CVE-2026-17583"
  - "https://attack.mitre.org/techniques/T1036/"
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-04
tags:
  - attack.defense_evasion
  - attack.t1565.001
  - attack.t1036
  - cve.2026.17583
logsource:
  category: file_change
  product: windows
  definition: Requires Sysmon EventCode 2 (FileWrite) or equivalent EDR file modification telemetry targeting .fsa/.hid file extensions
detection:
  selection:
    TargetFilename|endswith:
      - ".fsa"
      - ".hid"
    EventCode: 2
  filter_authorized:
    Image|endswith:
      - "\\GeneMapper_IDX.exe"
      - "\\3500_DataCollection.exe"
      - "\\3730_DataCollection.exe"
      - "\\SeqStudio.exe"
      - "\\SeqStudioFlex.exe"
  condition: selection and not filter_authorized
falsepositives:
  - "Laboratory backup or archiving software touching file metadata during backup operations"
  - "Antivirus or FIM software scanning forensic evidence storage"
  - "File copy operations for legitimate case file migration to archive"
level: critical
```

**Known false positives:**

- Backup/archiving software modifying file metadata on evidence storage
- Antivirus or file integrity monitoring scans touching evidence file contents
- Authorized migration of case files between storage tiers

**Tuning notes:** Build an allowlist of authorized Thermo Fisher instrument processes for the specific lab environment. For EOL instruments (3130, ABI PRISM) that cannot be patched, monitoring unauthorized file modification becomes the primary compensating detection. Consider adding SHA-256 baseline comparison for high-value evidence files.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Binary Manipulation Tools Executed on Forensic Lab Systems (locked: unlock with TL Creds)
- Evidence File Timestamp Manipulation and Event Log Clearing on Lab Systems (locked: unlock with TL Creds)
- Forensic Evidence File Staging and Exfiltration (locked: unlock with TL Creds)
- Custom ABIF Binary Tampering Script Execution (locked: unlock with TL Creds)
- ABIF Binary Structure Manipulation via API Call Patterns (locked: unlock with TL Creds)
- Anomalous Outbound Network Connections from Forensic Lab Infrastructure (locked: unlock with TL Creds)
- RDP Remote Access to Forensic Lab Workstations with Evidence File Access (locked: unlock with TL Creds)
- Bulk Forensic Evidence File Access via Network Shares (SMB) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [DNA Test Software Flaw Could Let Attackers Tamper With Forensic Evidence](https://cybersecuritynews.com/dna-test-software-vulnerability/)
- [Thermo Fisher Patches Flaw That Could Make DNA File Tampering Nearly Undetectable](https://thehackernews.com/2026/08/thermo-fisher-patches-flaw-that-could.html)
- [A flaw in crime-lab software let AI rewrite DNA evidence](https://thenextweb.com/news/thermo-fisher-dna-evidence-file-tampering-flaw-cve-2026-17583)
- [CVE-2026-17583 — Daily Security Review](https://dailysecurityreview.com/resources/thermo-fisher-patches-dna-file-tampering-flaw-cve-2026-17583/)
- [A security flaw in widely used crime-lab equipment exposed digital DNA evidence to undetectable tampering](https://www.theverge.com/science/974287/a-security-flaw-in-widely-used-crime-lab-equipment-exposed-digital-dna-evidence-to-undetectable-tampering)
- [DNA samples from crime-scene forensics can be modified and switched using an AI tool](https://www.techradar.com/pro/security/weve-been-behind-the-ball-for-so-long-experts-say-dna-samples-from-crime-scene-forensics-can-be-modified-and-even-switched-using-an-ai-tool)
- [DNA Test Software Vulnerability Allows Attackers to Alter Analysis Data](https://healsecurity.com/dna-test-software-vulnerability-allows-attackers-to-alter-analysis-data/)
- [Thermo Fisher Applied Biosystems Security Bulletin — July 31, 2026](https://corporate.thermofisher.com/us/en/index/about/information-security/Protecting-Our-Products/security-bulletins.html)
- [Wall Street Journal — DNA Evidence Flaw Allows Tampering, Researchers Say](https://www.wsj.com/)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [NVD — CVE-2026-17583](https://nvd.nist.gov/vuln/detail/CVE-2026-17583)
- [ABIF File Format Specification — Applied Biosystems](https://archive.gfjc.fiu.edu/workshops/resources/literature/ABIF_File_Format.pdf)
- [CISA Coordinated Vulnerability Disclosure Process](https://www.cisa.gov/coordinated-vulnerability-disclosure)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1854