Six Critical Flaws in J4Care dcm4chee Allow Unauthenticated Attackers to Steal, Forge, and Destroy Medical Imaging Records
On October 15, 2026, CISA issued ICS-Medical Advisory ICSMA-26-288-02 disclosing six critical and high-severity vulnerabilities in J4Care dcm4chee-arc-light 5.35.1, a widely deployed open-source clinical image archive used globally across healthcare and public health infrastructure. The flaws span missing authentication on DICOM and HL7 interfaces (CVE-2026-105279, CVE-2026-105667), missing authorization on storage management REST APIs (CVE-2026-97851), and denial-of-service conditions via malformed JPEG, MP4, and multipart inputs (CVE-2026-107621, CVE-2026-105273, CVE-2026-101021). Unauthenticated remote attackers can enumerate and exfiltrate patient records and medical images, inject forged diagnostic studies, permanently reassign patient identities across the archive, and trigger service outages—all without credentials, over the network, at CVSS scores reaching 9.3. These vulnerabilities illustrate a persistent and dangerous pattern in healthcare ICS environments: medical imaging systems exposed on internal clinical networks frequently lack authentication on legacy DICOM and HL7 interfaces, creating zero-barrier pathways for patient data exfiltration and record manipulation. With ransomware groups and nation-state actors increasingly targeting healthcare infrastructure, unpatched imaging archives represent a direct compliance liability under HIPAA and an operational risk to patient safety.
Kill Chain
