Thermo Fisher Torrent Suite Software Path Traversal Vulnerability

Thermo Fisher Scientific has addressed a path traversal vulnerability identified as CVE-2026-107777 in Torrent Suite Software. The flaw affects versions 5.18 and earlier. According to the CISA Industrial Control Systems Advisory (ICSMA-26-288-01), successful exploitation could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account.

The vulnerability has been assigned a CVSS v3 base score of 6.5 (MEDIUM) and a CVSS v4 base score of 7.1 (HIGH). The v4 vector reflects the increased impact of the confidentiality breach (VC:H). The relevant CWE classification is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Thermo Fisher has fixed the vulnerability and recommends users update Torrent Suite Software to version 5.22 or later. The vulnerability was reported to CISA by Akanksha Raghvesh and Abhinav Agarwal. CISA notes that no known public exploitation specifically targeting this vulnerability has been reported at this time. The advisory emphasizes minimizing network exposure for control system devices and ensuring they are not accessible from the internet.