Key points
- J4Care dcm4chee-arc-light version 5.35.1 is affected by CVE-2026-105279.
- The flaw allows remote peers to retrieve patient data and store fake studies.
- The default configuration accepts associations from unregistered calling AEs.
J4Care dcm4chee-arc-light version 5.35.1 contains a critical security flaw that allows remote attackers to access sensitive medical information. The vulnerability, tracked as CVE-2026-105279, stems from the application's default configuration accepting connections from unregistered sources.
What happened
The National Vulnerability Database records CVE-2026-105279 as a critical issue with a CVSS score of 9.1. The flaw exists within J4Care dcm4chee-arc-light version 5.35.1 and relates to improper session management, classified under CWE-306. In its default setup, the archive system accepts DICOM associations from any calling Application Entity, regardless of registration status. This behaviour bypasses standard authentication checks that would normally restrict access to authorised medical imaging systems only.
Why it matters
Remote peers can exploit this misconfiguration to enumerate and retrieve patient information and medical images using C-FIND and C-GET commands. Attackers do not need valid credentials to access this sensitive health data. Furthermore, the vulnerability allows adversaries to use C-STORE commands to file fabricated study content under existing patient identities. This capability enables the injection of false medical records into the archive, potentially compromising clinical decision-making and patient safety through data integrity violations.
What happens next
Security teams must verify if their J4Care dcm4chee-arc-light installations are running version 5.35.1. If the software is deployed in its default configuration, it is immediately vulnerable to unauthorised data access. Organisations should review their DICOM association logs for evidence of unregistered calling AEs attempting C-FIND, C-GET, or C-STORE operations. Immediate isolation of affected archives from untrusted networks is recommended until a remediation path is confirmed.
Patch priority
Teams should prioritise systems exposed to external networks or untrusted internal segments for immediate review. Check whether the default configuration is still active on production archives. Test any configuration changes in a non-production environment first to ensure clinical workflows remain uninterrupted. Back up existing archive data before making changes to system settings. Reduce exposure by restricting network access to only known, authorised medical imaging devices while a permanent fix is sought.
What to do and how to stay safe: J4Care
- Verify if J4Care dcm4chee-arc-light version 5.35.1 is deployed in your environment.
- Review network logs for DICOM associations from unregistered or unknown calling AEs.
- Restrict network access to the archive server to only authorised medical devices.
- Monitor for unusual C-STORE operations that may indicate fabricated content injection.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which version of J4Care dcm4chee-arc-light is affected?
Version 5.35.1 of J4Care dcm4chee-arc-light is affected by this vulnerability.
What is the CVSS score for CVE-2026-105279?
The CVSS score for CVE-2026-105279 is 9.1, which is rated as critical.
Can attackers modify patient records through this flaw?
Yes, attackers can use C-STORE to file fabricated study content under existing patient identities.
