Read the docs
TI-2026-75325 Aliases CVE-2026-105279

J4Care dcm4che Missing Authentication for Critical Function

Priority MEDIUM 48CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

In the default configuration, the dcm4chee-arc-light archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity. The weakness is CWE-306, and the CVSS 4.0 base score is 9.3 (CRITICAL).

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00274 19th percentileScored 2026-11-07
Fix Fixed dcm4chee-arc-light (J4Care): 5.35.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
J4Caredcm4chee-arc-light5.35.15.35.2Patch availableCNA
  • dcm4chee-arc-light VendorJ4Care Affected 5.35.1 Fixed in 5.35.2 Patch available CNA

Remediation

Upgrade dcm4chee-arc-light from 5.35.1 to 5.35.2, the fixed version listed by J4Care.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA dcm4chee-arc-light (J4Care) Fixed in 5.35.2

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-105279

References

Other 2

  • TI-2026-75334 Missing authorization in dcm4chee-arc-light enables object deletion CVSS 4.0HIGH 8.8
  • TI-2026-75328 Infinite loop in J4Care dcm4chee-arc-light JPEG parser CVSS 4.0HIGH 8.7
  • TI-2026-75324 J4Care dcm4che Loop with Unreachable Exit Condition CVSS 4.0HIGH 8.7
  • TI-2026-75323 Inefficient algorithm in J4Care dcm4chee-arc-light multipart parsing CVSS 4.0HIGH 8.7
  • TI-2026-75326 dcm4chee-arc-light accepts unauthenticated HL7 patient-merge messages CVSS 4.0HIGH 8.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences