DICOM Communication Vulnerability in Medical Imaging Systems
CVE-2026-105279

9.3CRITICAL

Key Information:

Vendor

J4care

Status
Dcm4chee-arc-light
Vendor
CVE Published:
16 October 2026

What is CVE-2026-105279?

A vulnerability exists in the default configuration of certain medical imaging systems that utilize DICOM protocol. Specifically, the system accepts DICOM associations from unregistered calling Application Entities (AEs). This allows remote attackers to utilize C-FIND and C-GET commands to enumerate sensitive patient information and medical images. Moreover, the attackers can exploit C-STORE to upload fabricated study content under a legitimate patient’s identity, posing significant risks to patient privacy and data integrity.

Affected Version(s)

dcm4chee-arc-light 5.35.1

dcm4chee-arc-light 5.35.2

References

https://www.cisa.gov/news-events/ics-medical-advisories/i...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhinav Agarwal reported this vulnerability to CISA.
.