Unauthorized Patient-Merge Vulnerability in HL7 Listener by CISA
CVE-2026-105667

8.7HIGH

Key Information:

Vendor

J4care

Status
Dcm4chee-arc-light
Vendor
CVE Published:
16 October 2026

What is CVE-2026-105667?

The HL7 Listener, when configured with default settings, lacks authentication for incoming ADT^A40 patient-merge messages. This flaw enables a remote sender to manipulate patient identities, potentially reassigning medical studies and workflow records from one patient to another. It's critical to note that the archive's unmerge function does not reverse these unauthorized changes, posing significant risks to patient data integrity and security.

Affected Version(s)

dcm4chee-arc-light 5.35.1

dcm4chee-arc-light 5.35.2

References

https://www.cisa.gov/news-events/ics-medical-advisories/i...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhinav Agarwal reported this vulnerability to CISA.
.