J4Care dcm4chee-arc-light: Missing authentication for critical function in DICOM service
Summary
In the default configuration, the DICOM archive dcm4chee-arc-light accepts DICOM associations from unregistered calling AE titles without authentication. A remote attacker can use C-FIND and C-GET to enumerate and retrieve patient information and medical images, and use C-STORE to file fabricated studies under an existing patient identity. The attack requires only network access to the DICOM listener and no credentials.
Affected
- J4Care dcm4chee-arc-light 5.35.1 (listed as affected by CISA)
- Whether older releases are affected: Unknown.
Fixed in
- Release 5.35.2 or later (vendor recommendation).
- Confirmation that 5.35.2 fully covers CVE-2026-105279: Unknown, to be confirmed with J4Care.
Workaround
- No vendor-published workaround for this CVE is known.
- Restrict the DICOM listener to known modalities and PACS by IP address and firewall rules.
- Keep the archive off the public internet.
Exploitation
- CISA reports no known public exploitation specifically targeting these vulnerabilities.
- No public proof of concept confirmed.
- Not listed in CISA KEV. EPSS: 0.00241.
- CISA SSVC: automatable yes, technical impact total.
Our recommendation
- Identify all dcm4chee-arc-light instances and their versions.
- Upgrade to 5.35.2 or later after testing, and ask J4Care to confirm in writing that the fix covers this CVE.
- Until patched, restrict DICOM and web access to known networks and keep the system off the internet.
- Check studies, patient records and deletions for unexpected changes and review backups and audit logs for the affected period.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICS Medical Advisory ICSMA-26-288-02 www.cisa.gov
- CISA CSAF file ICSMA-26-288-02 github.com
- Tenable CVE-2026-105279 www.tenable.com
- dcm4chee-arc-light release 5.35.2 github.com
- Positive Technologies record PT-2026-115619 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:31.
Original description (NVD)
In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.