CVE-2026-105279: dcm4chee-arc-light DICOM Archive Accepts Unauthenticated Peer Connections

Overview

A critical missing-authentication flaw has been disclosed in dcm4chee-arc-light, the open-source DICOM archive maintained by J4Care that hospitals and imaging centers use as a PACS (Picture Archiving and Communication System) backend. Tracked as CVE-2026-105279 with a CVSS v3.1 score of 9.1 (CVSS v4: 9.3), the flaw means that in the archive's default configuration, the system accepts DICOM associations from any unregistered calling Application Entity (AE) — no credentials, API key, or prior registration required.

A remote peer that can simply reach the archive's DICOM port can immediately start issuing standard DICOM protocol commands as if it were a trusted modality or workstation.

Technical Details

How It Works

DICOM's association model relies on a calling AE title to identify which modality, workstation, or system is connecting to an archive. dcm4chee-arc-light's default configuration does not require that calling AE to be pre-registered or authenticated before the archive processes its requests. An attacker who can reach the DICOM listener over the network can open an association using any arbitrary AE title and then issue:

• C-FIND — to search and enumerate patient records, study metadata, and accession numbers stored in the archive
• C-GET — to retrieve full DICOM image series and associated patient information
• C-STORE — to upload fabricated image or report content and file it under an existing patient's identity, effectively planting forged study data into a real patient's medical record

Because none of this requires prior registration, the barrier to exploitation is simply network reachability to the DICOM service port.

Impact Assessment

This CVE was disclosed alongside five related dcm4chee-arc-light flaws — including CVE-2026-97851 (unauthorized storage purge, covered separately), two infinite-loop denial-of-service bugs in its JPEG/MP4 parsers, a resource-exhaustion issue in multipart stream handling, and an unauthenticated HL7 patient-merge flaw — all patched together in 5.35.2. CISA published the group as ICS Medical Advisory ICSMA-26-288-02 given the software's footprint in the Healthcare and Public Health sector.

Who Is At Risk

Any organization running a dcm4chee-arc-light instance ≤ 5.35.1 that is reachable by an untrusted network is exposed, including deployments that:

• Expose the DICOM listener (commonly port 104 or 11112) beyond a tightly controlled imaging VLAN
• Rely on AE title allow-listing being enabled by an administrator rather than being the shipped default
• Integrate with multiple hospitals, clinics, or referring physicians over shared or partially segmented networks

Potential Attack Chains

1. Reconnaissance — Attacker scans for reachable DICOM services and opens an association with an arbitrary AE title
2. Enumeration — C-FIND queries pull patient names, IDs, accession numbers, and study lists without any credential check
3. Exfiltration — C-GET retrieves the actual imaging studies and embedded patient demographics
4. Record Poisoning — C-STORE files attacker-supplied content under an existing patient identity, corrupting the clinical record with fabricated studies or reports

Given the archive's role as a system of record for diagnostic imaging, both the confidentiality breach (bulk PHI exposure) and the integrity breach (forged studies attributed to real patients) carry direct patient-safety implications, not just a data-protection one.

Mitigation

Immediate Actions

• Upgrade to dcm4chee-arc-light 5.35.2 or later, which enforces AE-title registration before an association is accepted
• Where upgrading isn't immediately possible, restrict network access to the DICOM listener to known modality and workstation IP ranges via firewall or network segmentation
• Audit existing AE title configuration to confirm registered-AE enforcement isn't already disabled or left at a permissive default
• Review recently stored studies for signs of unexpected content that doesn't match ordering/referring physician records

Detection Opportunities

• Monitor DICOM association logs for calling AE titles that don't match your known inventory of modalities and workstations
• Alert on C-FIND/C-GET activity from AE titles seen for the first time, especially from network segments outside imaging equipment subnets
• Flag C-STORE operations that add studies to existing patients outside expected acquisition workflows

Defence-in-Depth

• Segment DICOM traffic onto a dedicated VLAN isolated from general hospital IT and guest networks
• Pair AE-title checks with network-layer controls (ACLs/mTLS where supported) rather than relying on AE title alone, since it is a client-supplied value
• Include PACS/VNA systems in routine vulnerability scanning and patch management cycles, not just EHR and clinical applications

Discovery & Disclosure

CVE-2026-105279 was reported by Abhinav Agarwal and published as part of CISA's ICSMA-26-288-02 advisory alongside five other dcm4chee-arc-light CVEs, all fixed in the 5.35.2 release. As of publication, it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no public proof-of-concept has been observed, but the zero-authentication, zero-interaction attack path against systems holding protected health information warrants urgent patching.

References

• CISA — ICS Medical Advisory ICSMA-26-288-02: J4Care dcm4che
• NVD — CVE-2026-105279
• Strix — CVE-2026-105279: dcm4chee-arc-light Missing Authentication