REST Service Vulnerability in DICOM Storage Management
CVE-2026-97851

8.8HIGH

Key Information:

Vendor

J4care

Status
Dcm4chee-arc-light
Vendor
CVE Published:
16 October 2026

What is CVE-2026-97851?

A vulnerability exists in the storage management of DICOM systems that allows location records still linked to DICOM instances to be erroneously altered to deletion states. When a location is switched to the TO_DELETE status, the associated PurgeStorageScheduler can maliciously delete the linked object from storage, even while the instance record continues to reside in the database. This flaw can lead to significant data integrity issues and loss of crucial medical imaging records.

Affected Version(s)

dcm4chee-arc-light 5.35.1

dcm4chee-arc-light 5.35.2

References

https://www.cisa.gov/news-events/ics-medical-advisories/i...
https://github.com/cisagov/CSAF/blob/develop/csaf_files/O...

CVSS V4

Score:
8.8
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhinav Agarwal reported this vulnerability to CISA.
.