CISA flags critical flaws in dcm4che DICOM archive letting attackers delete and forge medical images
CISA's medical advisory covers six vulnerabilities in J4Care's dcm4chee-arc-light, a DICOM archive used in healthcare settings worldwide. The flaws range from missing authentication and authorization to denial-of-service conditions, with top CVSS v3 scores of 9.1. For anyone running medical imaging infrastructure, this is a patch-now item: the defaults ship insecure, and the vendor fix is already out.
- Six CVEs affect dcm4chee-arc-light 5.35.1; J4Care recommends upgrading to release 5.35.2 or later.
- In the default configuration, the archive and HL7 listener accept unauthenticated requests, enabling retrieval, forgery and patient-record reassignment.
- Top CVSS v3 base score is 9.1 (critical); CISA reports no known public exploitation to date.
Executive summary
CISA published medical advisory ICSMA-26-288-02 on 15 October 2026, identifying six vulnerabilities in J4Care's dcm4chee-arc-light, version 5.35.1. The product is a DICOM archive used in the Healthcare and Public Health sector, deployed worldwide, from a vendor headquartered in Austria. CISA…
The executive summary, the full reported briefing, the analysis and the counterpoint are for subscribers — as is the audio.
You are not charged for 3 days and you can cancel at any time. Already subscribe? Sign in to hear this and everything else published today.
subscribers: executive summary · reported briefing · analysis · counterpoint · what to do · audio · video
Source documents
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02Read by Regulus 15 Oct 2026 at 17:07 UTC
17 factual claims checked against this document · 0 unsupported
Cited and linked; extract quoted under fair dealing