Six Critical Flaws in J4Care dcm4chee Allow Unauthenticated Attackers to Steal, Forge, and Destroy Medical Imaging Records
Executive Summary
On October 15, 2026, CISA issued ICS-Medical Advisory ICSMA-26-288-02 disclosing six critical and high-severity vulnerabilities in J4Care dcm4chee-arc-light 5.35.1, a widely deployed open-source clinical image archive used globally across healthcare and public health infrastructure. The flaws span missing authentication on DICOM and HL7 interfaces (CVE-2026-105279, CVE-2026-105667), missing authorization on storage management REST APIs (CVE-2026-97851), and denial-of-service conditions via malformed JPEG, MP4, and multipart inputs (CVE-2026-107621, CVE-2026-105273, CVE-2026-101021). Unauthenticated remote attackers can enumerate and exfiltrate patient records and medical images, inject forged diagnostic studies, permanently reassign patient identities across the archive, and trigger service outages—all without credentials, over the network, at CVSS scores reaching 9.3.
These vulnerabilities illustrate a persistent and dangerous pattern in healthcare ICS environments: medical imaging systems exposed on internal clinical networks frequently lack authentication on legacy DICOM and HL7 interfaces, creating zero-barrier pathways for patient data exfiltration and record manipulation. With ransomware groups and nation-state actors increasingly targeting healthcare infrastructure, unpatched imaging archives represent a direct compliance liability under HIPAA and an operational risk to patient safety.
Why This Matters Now
Healthcare networks are under sustained attack by ransomware groups and state-sponsored actors in 2026, and medical imaging archives sit at the intersection of patient safety and sensitive PHI. These flaws require no credentials to exploit over the network, meaning any attacker with internal network access—or access to an insufficiently segmented DICOM/HL7 port—can immediately exfiltrate imaging studies, corrupt patient records, or crash the archive. Organizations still running dcm4chee-arc-light 5.35.1 face active HIPAA breach exposure and potential patient harm from manipulated diagnostic records.
Attack Path Analysis
An unauthenticated remote attacker exploits missing authentication on the dcm4chee-arc-light DICOM and HL7 interfaces to gain direct access to patient records and medical imaging archives without any credential requirements. From there, the attacker abuses missing authorization on REST management endpoints to escalate operational control, manipulates patient identity records via unauthenticated HL7 ADT messages, moves laterally across the healthcare archive by pivoting through DICOM service endpoints and REST APIs, uses the archive's own legitimate functions as a covert channel, exfiltrates patient images and PHI via unauthenticated C-GET and REST queries, and ultimately causes impact through image deletion, record falsification, denial-of-service via malformed parser inputs, and irreversible patient record reassignment.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
The attacker discovers an internet- or network-exposed dcm4chee-arc-light 5.35.1 instance and exploits CVE-2026-105279, which allows any remote peer to establish DICOM associations without registering a calling Application Entity (AE) or authenticating. No credentials, phishing, or social engineering are required. The attacker immediately gains the ability to enumerate patient data using C-FIND, retrieve images using C-GET, and store fabricated studies using C-STORE under existing patient identities. The DICOM port is accessible directly from the network due to insufficient network segmentation.
Related CVEs
CVE-2026-97851
CVSS 9.1The storage status-change REST service in J4Care dcm4chee-arc-light 5.35.1 allows unauthenticated or unauthorized users to change location records to deletion-related states, causing PurgeStorageScheduler to delete referenced DICOM objects from storage while instance records remain in the database, resulting in permanent loss of medical images.
Affected Products:
J4Care dcm4chee-arc-light – 5.35.1
Exploit Status:
no public exploitCVE-2026-107621
CVSS 7.5JPEGParser in J4Care dcm4chee-arc-light 5.35.1 can enter an infinite loop when parsing a specially crafted or truncated JPEG stream, resulting in a denial-of-service condition that renders the archive unavailable.
Affected Products:
J4Care dcm4chee-arc-light – 5.35.1
Exploit Status:
no public exploitCVE-2026-105273
CVSS 7.5MP4Parser in J4Care dcm4chee-arc-light 5.35.1 does not adequately validate MP4 box sizes, allowing a malformed box to cause parsing to make no forward progress and repeatedly process the same input, leading to a denial-of-service condition.
Affected Products:
J4Care dcm4chee-arc-light – 5.35.1
Exploit Status:
no public exploitCVE-2026-101021
CVSS 7.5MultipartInputStream in J4Care dcm4chee-arc-light 5.35.1 performs inefficient boundary matching and unnecessary buffer copying, allowing crafted multipart input to force excessive boundary comparisons and repeated copying, resulting in a denial-of-service condition.
Affected Products:
J4Care dcm4chee-arc-light – 5.35.1
Exploit Status:
no public exploitCVE-2026-105279
CVSS 9.1In the default configuration of J4Care dcm4chee-arc-light 5.35.1, the archive accepts DICOM associations from unregistered calling Application Entities without authentication, allowing a remote peer to use C-FIND and C-GET to enumerate and retrieve patient information and medical images, and C-STORE to inject fabricated study content under existing patient identities.
Affected Products:
J4Care dcm4chee-arc-light – 5.35.1
Exploit Status:
no public exploitCVE-2026-105667
CVSS 7.5In the default configuration of J4Care dcm4chee-arc-light 5.35.1, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application, allowing a remote sender to permanently reassign studies and workflow records from one patient identity to another in an irreversible manner.
Affected Products:
J4Care dcm4chee-arc-light – 5.35.1
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Network Denial of Service
Data Destruction
Stored Data Manipulation
Data from Cloud Storage
Valid Accounts
Unsecured Credentials
Masquerading
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
HIPAA Security Rule (45 CFR Part 164) – Access Control and Person/Entity Authentication
Control ID: 164.312(a)(1) / 164.312(d)
HIPAA Security Rule (45 CFR Part 164) – Risk Analysis and Integrity Controls
Control ID: 164.306(a)(1) / 164.308(a)(1)(ii)(A)
NIST SP 800-53 Rev 5 – Access Enforcement, Remote Access, Identification and Authentication
Control ID: AC-3 / AC-17 / IA-2 / IA-9
NIS2 Directive (EU 2022/2555) – Risk Management Measures — Access Control and Authentication
Control ID: Article 21(2)(a) / Article 21(2)(e)
GDPR (EU 2016/679) – Security of Processing — Integrity, Confidentiality, and Ongoing Testing
Control ID: Article 32(1)(b) / Article 32(1)(d)
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Identity Verification for All Connections and Network Micro-Segmentation
Control ID: Identity Pillar — Authentication / Network Pillar — Segmentation
PCI DSS 4.0 – Vulnerability Management and Unique Authentication for All Users
Control ID: Requirement 6.3.3 / Requirement 8.2.1
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Health Care / Life Sciences
Critical dcm4chee-arc-light vulnerabilities enable unauthenticated DICOM access, patient record manipulation, and medical image deletion, violating HIPAA.164.312 and exposing PHI through unencrypted lateral movement pathways.
Medical Equipment
DICOM archive vulnerabilities (CVSS 9.1) allow forged study injection and patient identity reassignment via unauthenticated HL7 and DICOM interfaces, compromising imaging device workflow integrity and patient safety.
Medical Practice
Missing authentication on DICOM and HL7 listeners enables remote patient record reassignment and fabricated study filing, directly threatening clinical decision-making and HIPAA compliance across hospital and clinic environments.
Information Technology/IT
Healthcare IT teams managing dcm4chee deployments face critical zero-trust segmentation gaps; east-west lateral movement and egress exfiltration risks demand immediate NIST.800-53.SC-7 and ZTMM.Network remediation controls.
Sources
- J4Care dcm4chehttps://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02Verified
- J4Care dcm4chee-arc-light GitHub Repository and Release Noteshttps://github.com/dcm4che/dcm4chee-arc-light/releasesVerified
- CISA ICS Security Recommended Practiceshttps://www.cisa.gov/icsVerified
- NVD National Vulnerability Database - CVE Searchhttps://nvd.nist.gov/vuln/searchVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- dcm4che DICOM Toolkit Project - J4Carehttps://www.dcm4che.org/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant here because the attacker's entire campaign relied on unrestricted network reachability to unauthenticated DICOM and HL7 service endpoints exposed without segmentation. By enforcing identity-aware segmentation and controlled access paths around the medical imaging archive, CNSF would likely reduce the attacker's initial reach and limit the blast radius across clinical systems.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Enforcing a Zero Trust perimeter around the DICOM service would likely reduce the reachability of unauthenticated external peers to the archive's DICOM port, constraining the attacker's ability to establish arbitrary associations from unregistered sources and limiting early-stage enumeration and injection opportunities.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation applied to the REST management plane and HL7 listener would likely constrain which workloads or network segments can reach those sensitive endpoints, reducing the scope of unauthenticated callers who could invoke destructive storage operations or submit patient-merge commands.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely constrain the attacker's ability to pivot freely across DICOM-connected clinical systems by enforcing segmentation between the archive and peer modalities, reducing the reachability of internal service endpoints that would otherwise be traversable once the archive itself was accessed.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic visibility across the healthcare network would likely help surface anomalous protocol volumes, unexpected association patterns, and unusual combinations of DICOM and HL7 operations that diverge from established clinical baselines, making covert activity blending with legitimate traffic somewhat harder to sustain undetected.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policy enforcement around the DICOM archive would likely constrain outbound data flows to known, authorized destinations, reducing the attacker's ability to retrieve large volumes of patient imaging data and PHI to external or unrecognized endpoints outside of established clinical network paths.
If prior CNSF controls had constrained the attacker's reachability and east-west movement, the scope of impact would likely be reduced — destructive storage operations, record falsification, and denial-of-service attempts would remain confined to assets directly reachable through permitted paths rather than spanning the full archive and connected clinical environment.
Impact at a Glance
Affected Business Functions
- Medical Imaging Archive (DICOM PACS)
- Electronic Health Records (EHR) and Patient Identity Management
- Radiology and Clinical Workflow Services
- HL7 Health Information Exchange
Estimated downtime: 3 days
Estimated loss: N/A
Protected Health Information (PHI) of an indeterminate number of patients is at risk including diagnostic medical images (DICOM studies such as CT, MRI, X-ray), patient demographic records, study metadata, and workflow records. Exploitation of CVE-2026-105279 could allow unauthenticated enumeration and bulk retrieval of all stored DICOM studies and patient records. Exploitation of CVE-2026-105667 could result in permanent, irreversible reassignment of medical records to incorrect patient identities, creating patient safety risks. Exploitation of CVE-2026-97851 could result in permanent deletion of stored medical images with no recovery path. Fabricated study injection via C-STORE poses risks of misdiagnosis. This system is deployed worldwide in healthcare institutions, amplifying the breadth of potential PHI exposure and HIPAA regulatory liability.
Recommended Actions
Key Takeaways & Next Steps
- • Apply Zero Trust Segmentation immediately to isolate dcm4chee-arc-light DICOM (port 11112) and HL7 listener interfaces behind identity-based microsegmentation policies, restricting access exclusively to registered and authenticated AEs and HL7 sending applications — this directly addresses CVE-2026-105279 and CVE-2026-105667 by enforcing trust boundaries even before patching.
- • Deploy East-West Traffic Security controls to monitor and restrict DICOM service-to-service and modality-to-archive flows within the clinical network, preventing an attacker who gains initial DICOM access from pivoting to enumerate the full patient archive or impersonate connected imaging systems.
- • Enable Egress Security and Policy Enforcement with FQDN/destination filtering on outbound DICOM and REST traffic from the archive server to block unauthorized bulk C-GET exfiltration of PHI and medical images to non-whitelisted external destinations, directly mitigating the primary exfiltration vector exploited via CVE-2026-105279.
- • Leverage Multicloud Visibility and Control (centralized traffic observability and anomaly detection) to baseline normal DICOM C-FIND/C-GET/C-STORE volumes and HL7 message rates, enabling detection of anomalous bulk enumeration, mass retrieval, or unexpected ADT^A40 patient-merge message volumes that indicate active exploitation of CVE-2026-105667 or CVE-2026-97851.
- • Deploy Inline IPS with Suricata signatures targeting malformed DICOM, JPEG, and MP4 parsing payloads to detect and block denial-of-service exploitation attempts against CVE-2026-107621, CVE-2026-105273, and CVE-2026-101021 before they reach the vulnerable parser, while prioritizing vendor patch deployment to release 5.35.2 as the definitive remediation across all six CVEs.
