CISA Warns of Critical dcm4che PACS Flaws — Healthcare Imaging Data at Risk

As reported by CISA in advisory ICSMA-26-288-02, six vulnerabilities in J4Care's dcm4chee-arc-light — a widely deployed DICOM-based PACS (Picture Archiving and Communication System) — expose healthcare organizations to data destruction, patient information disclosure, and study forgery. The most severe flaw, CVE-2026-97851, carries a CVSS v3.1 base score of 9.1 (Critical) and stems from missing authorization on a storage status-change REST endpoint, enabling unauthenticated attackers to mark medical image storage locations as deletable — silently purging clinical imaging data while leaving dangling database records.

Vulnerability Summary

Affected Product: dcm4chee-arc-light 5.35.1Patch Available: Yes — upgrade to release 5.35.2 or laterActive Exploitation: Not confirmed in the wild at time of advisoryAttack Surface: Network-accessible (AV:N), low complexity, no privileges or user interaction required for the critical CVE

Why This Matters

The implications extend well beyond a typical software patch cycle. dcm4che is a Java-based, open-source DICOM implementation used in PACS and vendor-neutral archives across hospitals, clinics, and regional health information exchanges worldwide. When a PACS platform loses authorization controls on its REST API, the blast radius is clinical — not merely IT.

Consider the workflow: radiologists and clinicians make diagnostic decisions based on what the archive presents. If an attacker can delete stored images, inject forged studies, or reassign patient records to different identities, the integrity of the entire diagnostic chain collapses — potentially with patient safety consequences that HIPAA breach notification alone cannot capture.

Three of the six CVEs map to CWE-862 (Missing Authorization), which signals a systemic gap in the access-control layer of the REST API rather than a single isolated logic error. This pattern suggests that other endpoints — beyond those currently enumerated — may share the same weakness. Security teams should treat the published patch as a necessary but not sufficient control and demand assurance from J4Care that a comprehensive authorization audit was performed across the codebase.

The CWE-835 infinite loop in JPEGParser (CVE-2026-107621) adds a complementary denial-of-service vector: a single crafted or truncated image stream can hang parser threads, degrading availability of the archive service — a scenario where PACS downtime directly delays imaging-dependent clinical workflows.

Who Is at Risk

• Hospital and clinic networks running dcm4chee-arc-light 5.35.1 with REST services exposed to broad internal or external networks
• Teleradiology and health information exchange deployments where DICOM endpoints face partner networks or the internet
• Small and mid-size facilities that rely on the open-source dcm4che stack without the segmentation budgets of large IDNs
• Organizations under regulatory obligations (HIPAA, GDPR, EU MDR) where patient data exposure or record integrity compromise triggers mandatory breach reporting

Shield53 Recommendations

Immediate Actions

• Upgrade to dcm4chee-arc-light 5.35.2 or later on all production and non-production instances. Validate the build hash against J4Care's official distribution.
• Inventory and segment PACS REST endpoints. Confirm that dcm4che REST services are not reachable from untrusted networks. Apply allowlisting at the network layer — these services should never face the public internet.
• Enforce authentication at the reverse proxy or API gateway if you cannot immediately patch. Place mutual TLS or OAuth2 in front of the REST API to compensate for the missing application-layer authorization until upgrade is complete.
• Deploy detection logic for the exploitation pattern: monitor dcm4che REST calls that issue TO_DELETE state changes on storage locations associated with active DICOM instances. Any such call from an unauthenticated or unexpected source should trigger an alert and block.
• Audit DICOM instance integrity. Run a reconciliation between storage objects and database instance records post-patch. Dangling records indicate prior exploitation or silent data loss.
• Monitor for JPEGParser thread exhaustion. Track JVM thread states and response latency on image-parse endpoints. Sustained high thread counts with blocked parser threads may indicate CVE-2026-107621 exploitation attempts.

Broader Hardening

• Treat all PACS and DICOM archive REST APIs as Tier-1 clinical systems requiring the same access controls, logging, and network segmentation as EHR infrastructure.
• Implement DICOM-level metadata integrity controls — cryptographic checksums on stored studies — so that injected or modified studies are detectable at retrieval time.
• Review J4Care's security posture and demand a published security disclosure policy and committed SLA for future CVE remediation.

The convergence of missing authorization and missing authentication for critical functions in a system that stores and serves clinical imaging data is a serious signal. Healthcare security teams should not treat this as a routine vendor advisory — the potential for patient safety impact elevates it to board-level risk until patching is verified and integrity is confirmed.