CISA Flags Six Flaws in dcm4che PACS Software
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA advisory details six vulnerabilities in J4Care dcm4chee-arc-light 5.35.1 allowing patient data disclosure, record tampering and DoS; patch to 5.35.2.
CISA published an ICS Medical Advisory covering six vulnerabilities in J4Care's dcm4chee-arc-light, an open-source DICOM image archive (PACS) used worldwide in healthcare. The flaws include missing authorization on the storage status-change REST service allowing deletion of stored medical images (CVE-2026-97851), two infinite-loop denial-of-service conditions in JPEG and MP4 parsers (CVE-2026-107621, CVE-2026-105273), an inefficient-algorithm DoS via malformed multipart input (CVE-2026-101021), and two missing-authentication issues: unregistered DICOM peers can enumerate/retrieve patient data and inject fabricated studies via C-FIND/C-GET/C-STORE (CVE-2026-105279), and the HL7 listener accepts unauthenticated ADT^A40 patient-merge messages that can reassign patient studies in a way the archive's unmerge function cannot reverse (CVE-2026-105667).
Collectively, successful exploitation could let an attacker delete stored images, disclose patient information, inject forged studies, reassign patient records to the wrong identity, overwrite files, or cause denial of service — all serious integrity and confidentiality risks for clinical imaging workflows. All issues affect dcm4chee-arc-light version 5.35.1; J4Care has released fixes in 5.35.2. CISA states no known public exploitation has been reported at this time, and recommends standard ICS hardening: minimizing internet exposure, network segmentation/firewalling, and secure remote access via VPN.
Defenders running dcm4chee-arc-light should prioritize upgrading to 5.35.2 or later, verify that DICOM and HL7 listener interfaces are not exposed to untrusted networks, and review AE title registration and patient-merge message handling for anomalous activity.
Mentioned in this report
Detection guidance
HTTP DELETE Against dcm4chee-arc Studies REST Endpoint
Detects HTTP DELETE requests to the dcm4chee-arc-light studies REST service, which can remove stored medical images when authorization is missing or bypassed. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: HTTP DELETE Against dcm4chee-arc Studies REST Endpoint
description: Detects HTTP DELETE requests to the dcm4chee-arc-light studies REST service
(/dcm4chee-arc/.../rs/studies). Missing authorization on the archive's REST services
(storage status-change, CVE-2026-97851) can let an unauthenticated client delete
stored medical images. Deletions should come only from known admin or PACS integration
hosts. Tune by excluding those sources.
tags:
- attack.impact
- attack.t1485
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-method: DELETE
cs-uri-stem|contains|all:
- /dcm4chee-arc/
- /rs/studies
condition: selection
falsepositives:
- Authorized PACS administrators or retention and cleanup jobs deleting studies through
the REST API
- Integration engines that reject or delete studies as part of normal clinical workflow
level: medium
id: 431a7e18-5a4e-521b-a199-fcd87eb27b22
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02
External Source Connecting to DICOM or HL7 Listener Ports
Detects allowed inbound connections from non-private addresses to common DICOM and HL7 MLLP listener ports, the exposure needed to exploit the dcm4chee-arc-light unauthenticated DICOM and HL7 flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: External Source Connecting to DICOM or HL7 Listener Ports
description: Detects permitted inbound firewall connections from public (non-RFC1918)
addresses to common DICOM (104, 11112, 4242) and HL7 MLLP (2575, 2762) ports. The
dcm4chee-arc-light flaws allow unauthenticated C-FIND/C-GET/C-STORE and ADT^A40
patient-merge messages, so these listeners should never be reachable from untrusted
networks. Port list is based on common defaults and should be adjusted to the local
deployment.
tags:
- attack.initial-access
- attack.t1190
logsource:
category: firewall
detection:
selection:
dst_port:
- 104
- 11112
- 4242
- 2575
- 2762
action:
- allowed
- allow
- accept
filter_internal:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
condition: selection and not filter_internal
falsepositives:
- Legitimate external teleradiology or partner-hospital DICOM and HL7 peers reaching
the archive over approved paths
- Vulnerability scanners probing medical imaging ports
level: medium
id: 91c95fb7-215f-59a8-9a0b-604376ba461a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs