Live › vulnerability › CVE-2026-105279
Go to dashboardJ4Care dcm4chee-arc-light 5.35.1 (open-source DICOM archive/PACS) accepts associations from unregistered calling AE titles by default (CWE-306). A remote unauthenticated peer can list and download patient data and images with C-FIND/C-GET, and use C-STORE to add fabricated studies under real patient identities. CISA: no known public exploitation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| dcm4chee-arc-light | vendor | 5.35.1 | 5.35.2 |
5.35.1 release is affected)5.35.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.
This page as .md · .json · in your agent: get_signal("CVE-2026-105279")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.