Six flaws in J4Care's dcm4chee-arc-light let attackers delete or tamper with stored medical images

MedDevice Cyber Staff · 20 hrs ago · 4 min read · Via CISA ICSMA-26-288-02

CISA published ICSMA-26-288-02 on October 15, covering six vulnerabilities in dcm4chee-arc-light, the open source DICOM archive that J4Care maintains as part of the dcm4che toolkit. The advisory sets an aggregate CVSS 3.1 score of 9.1, critical. Version 5.35.1 carries all six; J4Care fixes them in 5.35.2. Researcher Abhinav Agarwal reported the set to CISA. CISA says it has no report of exploitation in the wild.

Two of the six are missing authentication bugs tracked as CWE-306. CVE-2026-105279 means the archive's default configuration accepts DICOM associations from any application entity, registered or not, so an outside caller can pull patient studies with C-FIND and C-GET or push fabricated images in with C-STORE, no credential required. CVE-2026-105667 sits in the HL7 listener: the default setup accepts ADT^A40 patient merge messages without checking who sent them, and once two patient records merge, the unmerge operation does not put them back. A third, CVE-2026-97851, is a missing authorization flaw, CWE-862, in the storage status change REST service: it lets a caller set the deletion state on location records tied to stored DICOM instances, which purges the underlying image data.

The remaining three are availability bugs. CVE-2026-107621 and CVE-2026-105273 are infinite loops, CWE-835, in the archive's JPEG and MP4 parsers: a crafted or truncated stream makes either parser loop forever instead of failing. CVE-2026-101021 is an inefficient algorithm bug, CWE-407, in the component that reads multipart HTTP uploads; its boundary matching does enough redundant buffer copying that a crafted upload can stall the service. None of the three needs valid credentials.

A DICOM archive is the system of record for a hospital's imaging. It is where studies land after acquisition and where every downstream reader, PACS viewer, and reporting tool pulls from. An attacker who can reach the archive's DICOM or HL7 listeners over the network, no login required thanks to CVE-2026-105279 and CVE-2026-105667, can read a patient's imaging history, inject a study that was never acquired, merge one patient's record into another's, or trigger the deletion path in CVE-2026-97851 and make the stored images disappear. A radiologist reading from a forged or deleted study is not a theoretical harm. It is a wrong read on a real patient.

J4Care fixes all six in dcm4chee-arc-light 5.35.2. CISA's mitigation beyond the upgrade is the standard advice for exposed clinical network services: minimize internet exposure, place the archive behind a firewall separate from the business network, and require an updated VPN for any remote access rather than exposing the DICOM or HL7 ports directly.

dcm4che is not a single vendor's product. It is open source infrastructure that sits inside PACS and archive deployments across the imaging industry, under whatever name a system integrator ships it. Two of six critical flaws being default configuration authentication gaps is the real story: software built to speak DICOM and HL7 inherited those protocols' original assumption that anyone on the network is trusted, and nobody closed that gap before shipping 5.35.1. Audit what runs on 5.35.1 today, not just what carries the J4Care name on an invoice.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade dcm4chee-arc-light to version 5.35.2 or later, which fixes all six CVEs, including the two missing authentication flaws that let unregistered callers reach patient imaging over DICOM and HL7. Until the upgrade runs, take the archive off any network that is not strictly limited to known imaging equipment and authorized integrations. There is no safe way to keep 5.35.1 running with its default configuration exposed.

Upgrade to dcm4chee-arc-light 5.35.2 or later. This release closes all six CVEs, including the authentication gaps on the DICOM and HL7 listeners.
Require authentication on DICOM associations. Do not rely on the default configuration; register and authenticate every application entity allowed to connect.
Firewall the archive off the general network. Expose DICOM and HL7 ports only to known imaging equipment and integrations, never broadly.
Require an updated VPN for remote access. Route any off site access to the archive through a current VPN rather than opening ports directly, per CISA's advisory guidance.

For Device ManufacturersFix the class in the product

The product exposes an interface with authentication off out of the box. As the maker, make the default configuration the secure configuration: require an admin credential before any interface serves data, and refuse to expose anything until setup is complete.

Default to authenticated. Block every data path until an admin credential is set on first boot.
Make insecure mode explicit. If an open mode must exist, it is a loud, logged, opt in choice, never the starting state.
Test the out of box state. Treat the shipped default as its own threat model.

Mapped EMB3D mitigations

Questions & Answers

What CVEs were disclosed in CISA advisory ICSMA-26-288-02 for J4Care's dcm4chee-arc-light?

ICSMA-26-288-02, published October 15, 2026, covers six CVEs in dcm4chee-arc-light 5.35.1: CVE-2026-97851, CVE-2026-107621, CVE-2026-105273, CVE-2026-101021, CVE-2026-105279, and CVE-2026-105667. CISA scored the set 9.1 on CVSS 3.1, critical. J4Care fixes all six in version 5.35.2.

Can dcm4chee-arc-light's default configuration be accessed without authentication?

Yes. CVE-2026-105279 means the default configuration accepts DICOM associations from unregistered application entities, letting an attacker pull or inject patient imaging data without credentials. CVE-2026-105667 similarly lets an unauthenticated sender trigger an HL7 patient merge that the system cannot cleanly reverse.

Is there a patch for the dcm4chee-arc-light vulnerabilities reported by Abhinav Agarwal?

Yes. J4Care patches all six vulnerabilities, reported by researcher Abhinav Agarwal, in dcm4chee-arc-light version 5.35.2. CISA also recommends minimizing network exposure, using firewalls, and requiring an updated VPN for remote access until the upgrade is complete.

← Back to Vulnerabilities