Multiple Critical Vulnerabilities in J4Care dcm4chee‑arc‑light (CVE‑2026‑97851, CVE‑2026‑107621, CVE‑2026‑105273, CVE‑2026‑101021, CVE‑2026‑105279, CVE‑2026‑105667) Threaten Imaging Integrity and Patient Privacy
What It Is – J4Care’s open‑source DICOM archive (dcm4chee‑arc‑light 5.35.1) contains six high‑severity flaws, including missing authorization, missing authentication for a critical REST service, an infinite‑loop condition, and an inefficient algorithm that can be abused to trigger denial‑of‑service.
Exploitability – The vulnerabilities are rated CVSS v3 9.1 (Critical). Exploits are publicly documented; an attacker who can reach the REST endpoint can delete or overwrite stored studies, inject forged images, reassign patient records, or crash the service.
Affected Products – J4Care dcm4chee‑arc‑light 5.35.1 (the “arc‑light” distribution of the dcm4che DICOM archive).
Why It Matters for Trust & Control Assurance
- Authorization & authentication controls – The flaws expose a gap in the control objective that requires “proper authorization for critical functions” and “strong authentication for privileged actions.”
- Data‑integrity assurance – Ability to inject or overwrite studies undermines the integrity evidence auditors expect for patient‑care workflows.
- Audit‑ready evidence – Continuous monitoring of access‑control logs and patch status provides the defensible trail regulators (e.g., HIPAA, NIST CSF) look for during inspections.
Recommended Actions
- Apply J4Care’s supplied patch immediately and verify the version is ≥ 5.35.2.
- Conduct a focused audit of all REST endpoints for missing authorization checks; map findings to the “authorization for critical functions” control area.
- Enable detailed request‑level logging and integrate logs into a SIEM for continuous monitoring of anomalous delete or update calls.
- Update your incident‑response playbook to include a “medical‑image integrity” scenario.
Source: CISA Advisory ICSMA‑26‑288‑02