Critical flaw in dcm4chee-arc-light allows unintended deletion of medical imaging data
A critical vulnerability in J4Care’s dcm4chee-arc-light enables the removal of stored DICOM objects while their database records remain intact, risking data loss.
Key points
- CVE-2026-97851 is rated Critical with a CVSS score of 9.1 by the National Vulnerability Database.
- The flaw affects J4Care dcm4chee-arc-light version 5.35.1 and involves improper validation of storage status changes.
- Exploitation triggers the PurgeStorageScheduler to delete physical files while leaving corresponding database entries behind.
The National Vulnerability Database has published a record for CVE-2026-97851, a critical vulnerability affecting J4Care’s dcm4chee-arc-light medical imaging archive software. The flaw allows the storage status-change REST service to change location records associated with DICOM instances to deletion-related states, triggering the removal of stored objects even when those instances are still referenced in the system.
At a glance
- CVE
- CVE-2026-97851
- Product
- J4Care dcm4chee-arc-light
- CVSS
- 9.1 Critical
- Weakness
- missing authorization
- Exploited
- No known exploitation
According to the NVD record, this vulnerability carries a CVSS score of 9.1, placing it in the Critical severity category. The weakness is classified under CWE-862. The issue specifically impacts version 5.35.1 of the dcm4chee-arc-light product, a component used in healthcare IT infrastructure for managing medical imaging data.
Technical Context and Mechanism
The vulnerability stems from how the storage status-change REST service handles location records associated with DICOM instances. The service permits these records to be changed to deletion-related states. When a location record is changed to the TO_DELETE state, the system’s PurgeStorageScheduler deletes the referenced object from storage.
This behavior creates an inconsistency between the physical storage layer and the database layer. The PurgeStorageScheduler deletes the actual medical imaging file from storage, but the corresponding instance record remains in the database. This leaves the database pointing to a file that no longer exists, effectively orphaning the record.
Who Is Affected
The primary target for this vulnerability is J4Care dcm4chee-arc-light version 5.35.1. Organizations using this specific version of the archive software are at risk of experiencing unintended data deletion. The flaw involves the storage status-change REST service allowing location records still associated with DICOM instances to be changed to deletion-related states.
Healthcare providers and medical imaging centers that rely on dcm4chee-arc-light for storing and retrieving DICOM data should verify their current software versions immediately. The persistence of database records after file deletion can lead to application errors and potential compliance issues regarding data integrity and availability in regulated healthcare environments.
What should you do?
No official patch or fix has been confirmed for CVE-2026-97851 as of the publication of this report. Administrators should monitor vendor communications for updates regarding version 5.35.1. In the interim, restricting access to the storage status-change REST service to authorized administrative accounts only may reduce the attack surface.
What to do and how to stay safe: J4Care
- Verify if your environment runs J4Care dcm4chee-arc-light version 5.35.1 and isolate it from untrusted networks if possible.
- Restrict access to the storage status-change REST service to prevent unauthorized modification of location records.
- Monitor system logs for unexpected invocations of the PurgeStorageScheduler or changes to TO_DELETE states.
- Implement regular backups of DICOM storage to ensure recovery capability in case of accidental or malicious deletion.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-97851?
CVE-2026-97851 is a critical vulnerability in J4Care dcm4chee-arc-light that allows the deletion of DICOM objects from storage while their database records remain.
Which software versions are affected?
The vulnerability specifically affects J4Care dcm4chee-arc-light version 5.35.1.
Is there a patch available for this flaw?
No fix has been confirmed yet for CVE-2026-97851.
