noindex and left out of the sitemap until more data is confirmed.CVE-2026-107777 is a path traversal vulnerability in Thermo Fisher's Torrent Suite genomic-sequencing software that lets an authenticated attacker read arbitrary files on the Torrent Server that the web service account can access; NVD has not yet completed its own CVSS scoring or CPE analysis, so this page is held as noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.3%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-16
Published
Vulnerability ID: CVE-2026-107777 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Thermo Fisher Torrent Suite Software | — | 0 through 5.18 (fixed in 5.22); not yet a published NVD CPE applicability statement |
What this means
CVE-2026-107777 (CWE-22, improper limitation of a pathname to a restricted directory) affects Thermo Fisher's Torrent Suite Software, the server application used to control and analyze runs on Ion Torrent next-generation DNA sequencing instruments. NVD's description, submitted by the ICS-CERT coordinator, states the product "is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account" (NVD).
NVD tracks the CVE with status "Awaiting Analysis" as of 2026-10-21: it records the submitter's CVSS v4.0 score of 7.1 (high), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N, and a CVSS v3.1 score of 6.5 (medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, but has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting the submitted figures as NVD-confirmed (NVD).
CISA's corresponding ICS Medical Advisory, released 2026-10-15, confirms Torrent Suite Software versions through 5.18 are affected and fixed in version 5.22, and credits researchers Akanksha Raghvesh and Abhinav Agarwal with reporting the issue to CISA (CISA ICS Medical Advisory ICSMA-26-288-01).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-21, and FIRST scores the probability of exploitation at 0.00316 (23.282th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, Torrent Suite operators should update to version 5.22 or later and review web service account file permissions.
Evidence
- Authenticated attacker can exploit a path traversal flaw to read arbitrary files on the Torrent Server accessible to the web service account (CWE-22). — NVD
- NVD status is "Awaiting Analysis" with submitter-reported CVSS v4.0 7.1 (high) and CVSS v3.1 6.5 (medium); no NVD-published score or CPE configuration as of 2026-10-21. — NVD
- Affects Torrent Suite Software through version 5.18, fixed in 5.22; reported by Akanksha Raghvesh and Abhinav Agarwal. — CISA ICS Medical Advisory ICSMA-26-288-01
- Not present in the CISA KEV catalog as of 2026-10-21. — CISA KEV
- EPSS score is 0.00316 (23.282th percentile) as of 2026-10-21. — FIRST EPSS
