On October 15, 2026, CISA released an advisory detailing six vulnerabilities affecting J4Care dcm4chee-arc-light version 5.35.1. Successful exploitation could allow attackers to delete medical images, disclose patient information, and cause denial-of-service conditions.
Vulnerability Overview
According to CISA, version 5.35.1 of J4Care dcm4chee-arc-light is impacted by six CVEs, including CVE-2026-97851, CVE-2026-107621, CVE-2026-105273, CVE-2026-101021, CVE-2026-105279, and CVE-2026-105667. These security issues involve missing authorization, infinite loops, inefficient algorithmic complexity, and missing authentication for critical functions.
The vulnerabilities carry CVSS version 3 base scores reaching up to 9.1 for critical severity issues. Abhinav Agarwal reported these vulnerabilities to CISA.
Potential Impact
CISA stated that successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images and overwrite files. Attackers could also disclose patient information, inject forged studies, and reassign patient records.
Additional impacts include causing a denial-of-service condition. CISA noted that no known public exploitation specifically targeting these vulnerabilities has been reported at this time.
Mitigation and Guidance
J4Care has provided a fix for the vulnerabilities and recommends users implement release 5.35.2 or later. CISA also recommends minimizing network exposure for all control system devices and isolating them behind firewalls.
What to do
- Implement release 5.35.2 or later of J4Care dcm4chee-arc-light.
- Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
- Locate control system networks and remote devices behind firewalls and isolate them from business networks.
- Use more secure methods, such as Virtual Private Networks (VPNs), when remote access is required.
Key facts and where they come from
- J4Care dcm4chee-arc-light version 5.35.1 is affected by six vulnerabilities.
dcm4chee-arc-light 5.35.1 (CVE-2026-97851, CVE-2026-107621, CVE-2026-105273, CVE-2026-101021, CVE-2026-105279, CVE-2026-105667)
- Successful exploitation can lead to medical image deletion and patient data disclosure.
Successful exploitation of these vulnerabilities could allow an attacker to delete stored medical images, disclose patient information
- J4Care recommends upgrading to release 5.35.2 or later.
J4Care recommends users implement release 5.35.2 or later.
