Executive Summary
In June 2026, a critical vulnerability (CVE-2026-56445) was identified in the pydicom pynetdicom library, specifically affecting versions from 1.0.0 up to and including 3.0.4. This flaw resides in the qrscp application's C-STORE handler, which improperly handles attacker-supplied DICOM datasets, allowing unauthenticated attackers to write files to arbitrary paths on the server. The vulnerability poses significant risks, particularly to the healthcare sector, as it could lead to unauthorized data manipulation or system compromise.
The maintainers of pynetdicom have not yet released a fix for this vulnerability. Organizations utilizing affected versions are advised to restrict network exposure of the qrscp DICOM port (default 11112) to trusted peers, implement firewall protections, and monitor for updates from the project's repository. This incident underscores the importance of securing medical imaging software against potential cyber threats.
Why This Matters Now
The absence of an official patch for CVE-2026-56445 leaves healthcare systems vulnerable to potential exploitation. Immediate mitigation measures are crucial to prevent unauthorized access and ensure the integrity of medical imaging data.
Attack Path Analysis
An unauthenticated attacker exploited a path traversal vulnerability in the pynetdicom library's qrscp application to write files to arbitrary paths on the server. This allowed the attacker to escalate privileges by placing malicious scripts in executable directories. The attacker then moved laterally within the network by accessing other systems using the compromised server. A command and control channel was established to remotely control the compromised systems. Sensitive data was exfiltrated from the network to an external server. Finally, the attacker deployed ransomware to encrypt critical files, causing significant operational disruption.
Kill Chain Progression
Initial Compromise
Description
An unauthenticated attacker exploited a path traversal vulnerability in the pynetdicom library's qrscp application to write files to arbitrary paths on the server.
Related CVEs
CVE-2026-56445
CVSS 9.1The qrscp application's C-STORE handler in pynetdicom versions 1.0.0 through 3.0.4 uses attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowing file writes to arbitrary paths.
Affected Products:
pydicom pynetdicom – >=1.0.0, <=3.0.4
Exploit Status:
no public exploitCVE-2026-32711
CVSS 7.8pydicom versions 2.0.0-rc.1 through 3.0.1 are vulnerable to Path Traversal through a maliciously crafted DICOMDIR ReferencedFileID, allowing arbitrary file read/copy and, in some flows, move/delete outside the File-set root.
Affected Products:
pydicom pydicom – >=2.0.0-rc.1, <=3.0.1
Exploit Status:
proof of concept
MITRE ATT&CK® Techniques
Exploitation for Client Execution
Ingress Tool Transfer
Impair Defenses: Disable or Modify Tools
Valid Accounts
Inhibit System Recovery
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 – Information Input Validation
Control ID: SI-10
PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Applications and Workloads
Control ID: Pillar 3
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Health Care / Life Sciences
Critical DICOM library path traversal vulnerability enables unauthorized medical data access, compromising patient privacy and HIPAA compliance across healthcare infrastructure.
Medical Equipment
Medical imaging devices using pynetdicom library face supply-chain attacks allowing arbitrary file writes, potentially corrupting diagnostic data and device integrity.
Computer Software/Engineering
Supply-chain vulnerability in widely-deployed pydicom library exposes software applications to path traversal attacks, requiring immediate patching and security controls.
Pharmaceuticals
Clinical trial data and research systems using affected DICOM libraries risk data integrity breaches, impacting regulatory compliance and intellectual property.
Sources
- pydicom pynetdicom Libraryhttps://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-176-01Verified
- NVD Entry for CVE-2026-56445https://nvd.nist.gov/vuln/detail/CVE-2026-56445Verified
- GitHub Security Advisory GHSA-v856-2rf8-9f28https://github.com/pydicom/pydicom/security/advisories/GHSA-v856-2rf8-9f28Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could have significantly limited the attacker's ability to move laterally, escalate privileges, and exfiltrate data by enforcing strict segmentation and identity-aware policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: While the initial exploitation may still occur, the attacker's subsequent actions would likely be constrained, limiting their ability to escalate privileges or move laterally.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges would likely be constrained, reducing the risk of gaining higher-level access.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally would likely be constrained, reducing the risk of accessing additional systems.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish command and control channels would likely be constrained, reducing the risk of remote control over compromised systems.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate data would likely be constrained, reducing the risk of data loss.
The attacker's ability to deploy ransomware would likely be constrained, reducing the risk of widespread operational disruption.
Impact at a Glance
Affected Business Functions
- Medical Imaging Systems
- Patient Data Management
Estimated downtime: 3 days
Estimated loss: $50,000
Potential exposure of patient medical images and associated metadata.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement within the network.
- • Deploy East-West Traffic Security controls to monitor and control internal traffic flows.
- • Utilize Egress Security & Policy Enforcement to prevent unauthorized data exfiltration.
- • Establish Threat Detection & Anomaly Response mechanisms to identify and respond to malicious activities.
- • Ensure all software components are regularly updated to mitigate known vulnerabilities.
