J4Care dcm4chee-arc-light: Missing authorization in storage status change

Summary

The storage status-change REST service of dcm4chee-arc-light, a DICOM medical image archive, accepts location records that are still linked to DICOM instances and allows them to be set to deletion-related states. Setting a location to TO_DELETE causes the PurgeStorageScheduler to delete the stored object, while the instance record remains in the database. An attacker who can reach the REST service may therefore delete stored medical images, which can result in data loss in a clinical archive. Successful exploitation may also disclose patient information, inject forged studies, reassign patient records, overwrite files and cause a denial of service according to CISA.

Affected

• dcm4chee-arc-light 5.35.1 (CISA ICSMA-26-288-02)
• Versions before 5.35.1: not listed as affected by CISA
• Version 5.35.0: named by VulDB only, unconfirmed until J4Care confirms

Fixed in

• Release 5.35.2 or later (J4Care)

Workaround

• No separate workaround for this CVE is known. Upgrading to 5.35.2 or later is the fix.
• Restrict DICOM and REST access to known, trusted systems as an interim network measure. This is not a verified fix for this CVE.

Exploitation

• CISA reports no known public exploitation of these vulnerabilities at this time.
• No public proof-of-concept found.
• Not listed in CISA KEV according to a third-party site, not independently verified.
• CISA SSVC: exploitation none, automatable yes, technical impact partial.

Our recommendation

• Identify all dcm4chee-arc-light instances and their versions.
• Upgrade any instance at 5.35.1 to 5.35.2 or later.
• Until the upgrade is done, limit DICOM and REST access to trusted systems and verify that these interfaces are not reachable from untrusted networks.
• Check backups of the image archive and monitor for unexpected deletions.
• Ask any integrator or hosting provider who runs a DICOM archive for you to confirm their status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• CISA ICS Medical Advisory ICSMA-26-288-02 www.cisa.gov
• CSAF JSON ICSMA-26-288-02 github.com
• dcm4chee-arc-light Release 5.35.2 github.com
• threatint CVE-2026-97851 cve.threatint.com
• VulDB entry 421295 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 16:02.