J4Care dcm4chee-arc-light: Missing authentication for HL7 ADT^A40 patient merge

Summary

In the default configuration, the HL7 listener of dcm4chee-arc-light, a medical imaging archive, accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender without credentials can reassign studies and related workflow records from one patient identity to another. The archive's unmerge function does not reverse this change, so affected records must be corrected manually.

Affected

• dcm4chee-arc-light 5.35.1
• Earlier versions: unknown

Fixed in

• dcm4chee-arc-light 5.35.2 or later

Workaround

• No workaround documented by the vendor.
• Restrict access to the HL7 listener port to known, trusted systems and keep it off untrusted networks until the update is applied.

Exploitation

• No evidence of exploitation in the wild found.
• CISA SSVC: exploitation none, automatable yes.
• No public proof of concept found.

Our recommendation

• Check whether dcm4chee-arc-light is in use and whether version 5.35.1 is deployed.
• Update to 5.35.2 or later; the same release covers the other flaws in the CISA advisory ICSMA-26-288-02.
• Restrict HL7 and DICOM access to known systems and keep these services off the internet.
• Review HL7 interface logs and the archive for unexpected ADT^A40 messages and misassigned studies, and correct any found manually.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CISA ICS Medical Advisory ICSMA-26-288-02 www.cisa.gov
• CISA CSAF document ICSMA-26-288-02 github.com
• dcm4chee-arc-light releases github.com
• HL7 v2.3 ADT^A40 trigger event hl7-definition.caristix.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:18.