A CISA medical advisory published this week describes a vulnerability set that does not steal records so much as bend them, and that distinction matters more in radiology than anywhere else in the hospital.
The advisory covers J4Care dcm4chee-arc-light 5.35.1, an open-source DICOM archive and PACS component deployed widely across healthcare and public health. Six flaws carry a vendor CVSS of 9.1 and span missing authentication on critical functions and absent authorization checks, alongside an infinite loop and inefficient algorithmic complexity.
Exploitation could let an unauthenticated attacker delete stored images, read patient information, inject forged studies, reassign records between patients, overwrite files or knock the archive offline. The integrity outcomes are the worrying ones: a misfiled study or a planted image leaves no obvious trace for the radiologist reading it. CISA has no reports of public exploitation targeting these flaws. J4Care fixed them in 5.35.2.
The CVEs are CVE-2026-97851, CVE-2026-107621, CVE-2026-105273, CVE-2026-101021, CVE-2026-105279 and CVE-2026-105667. Researcher Abhinav Agarwal reported them.
The hidden risk is inventory. dcm4chee-arc-light frequently ships embedded inside commercial viewers and vendor imaging suites, so the version question has to go to imaging vendors, not just to the server team. Security leaders should also ask whether the archive logs who deleted or reassigned a study, whether anyone reviews those logs, and whether a second copy exists for comparison.
CISA recommends pulling the archive off the public internet, segmenting it from business networks, and running an impact assessment before upgrading.
A3_TAGLINE: Six flaws in a widely embedded DICOM archive could let an unauthenticated attacker delete images or reassign studies between patients without leaving a visible mark.
A3_SOURCES: CISA|https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02;;Pulse by Adyog|https://pulse.adyog.com/insights/dcm4che-medical-image-flaws-cisa-icsma-26-288-02
A3_TAGS: medical device security, DICOM, CISA advisory, dcm4che, medical imaging, PACS vulnerabilities, CVE-2026-97851
