Critical flaw in J4Care dcm4chee-arc-light allows remote patient data theft
A critical vulnerability in J4Care’s medical archive software lets attackers steal patient records and inject fake medical data without authentication.
Key points
- CVE-2026-105279 is rated critical with a CVSS score of 9.1.
- The flaw allows unregistered peers to retrieve patient information and images.
- Attackers can also store fabricated study content under existing patient identities.
J4Care dcm4chee-arc-light version 5.35.1 contains a critical security vulnerability that allows remote attackers to access sensitive medical data. The National Vulnerability Database lists this issue as CVE-2026-105279 with a CVSS score of 9.1, indicating severe risk to healthcare systems using this default configuration.
At a glance
- CVE
- CVE-2026-105279
- Product
- J4Care dcm4chee-arc-light
- CVSS
- 9.1 Critical
- Weakness
- missing authentication
- Exploited
- No known exploitation
The vulnerability stems from the archive accepting DICOM associations from unregistered calling application entities. This misconfiguration enables remote peers to perform unauthorized actions on the server. Attackers can use standard DICOM commands to enumerate patient information and retrieve medical images without proper authentication or authorization checks.
Context and Background
The weakness is categorized under CWE-306, which relates to incorrect default permissions. In the default setup of the affected software, the system does not verify the identity of incoming connections before allowing data exchange. This allows any remote peer to interact with the archive as if it were a trusted entity within the local network.
According to the NVD record, attackers can exploit this flaw using C-FIND and C-GET commands. These operations allow them to search for and download patient records and associated medical images. The ability to retrieve this data remotely poses a significant privacy risk to patients whose information is stored in these archives.
Who is Affected
The specific product affected is J4Care dcm4chee-arc-light, version 5.35.1. Organizations running this version with default settings are vulnerable to unauthorized access. The flaw allows not only data exfiltration but also data manipulation, which can compromise the integrity of medical records.
Attackers can use the C-STORE command to file fabricated study content under an existing patient identity. This means malicious actors can insert false medical data into patient records. Such manipulation could lead to incorrect diagnoses or treatments if healthcare providers rely on the compromised archive for clinical decisions.
What should you do?
No patch or update has been confirmed yet for this vulnerability. Administrators should assume that systems running version 5.35.1 are exposed if they use default configurations. Immediate action is required to restrict network access to the archive and monitor for unusual DICOM traffic patterns.
What to do and how to stay safe: J4Care
- Restrict network access to the dcm4chee-arc-light server to only trusted internal networks and known application entities.
- Monitor server logs for incoming C-FIND, C-GET, and C-STORE requests from unregistered or unknown calling AE titles.
- Verify that your deployment does not use the default configuration that accepts associations from unregistered peers.
- Contact J4Care support to inquire about available patches or configuration guides to mitigate CVE-2026-105279.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVSS score for CVE-2026-105279?
The CVSS score for CVE-2026-105279 is 9.1, which is classified as critical severity.
Which version of dcm4chee-arc-light is affected?
Version 5.35.1 of J4Care dcm4chee-arc-light is affected by this vulnerability.
Can attackers modify patient records with this flaw?
Yes, attackers can use C-STORE to file fabricated study content under existing patient identities.
