---
id: "CVE-2026-105279"
kind: "vulnerability"
aliases: ["CVE-2026-105279"]
title: "In the default configuration, the archive accepts DICOM associations from an unregistered calling AE"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "dcm4chee-arc-light", "fixed": ["5.35.2"], "affected": "5.35.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["dcm4chee", "dicom", "healthcare", "infrastructure", "self-hosted"]
not_affected_if: ["default-config", "not-exposed-to-network"]
published_at: "2026-10-16T15:17:04+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-23T23:32:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105279", "first_seen_at": "2026-10-23T21:57:13+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:32:30+00:00"}]
---

# In the default configuration, the archive accepts DICOM associations from an unregistered calling AE

J4Care dcm4chee-arc-light 5.35.1 (open-source DICOM archive/PACS) accepts associations from unregistered calling AE titles by default (CWE-306). A remote unauthenticated peer can list and download patient data and images with C-FIND/C-GET, and use C-STORE to add fabricated studies under real patient identities. CISA: no known public exploitation.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:dcm4chee-arc-light affected 5.35.1 fixed 5.35.2

## How to check

Check the version of dcm4chee-arc-light (the 5.35.1 release is affected). Then check whether the archive's port 104/11112 is reachable from untrusted networks. From another host, try a C-ECHO or C-FIND with a made-up calling AE title, for example with dcmtk echoscu -aec <archive AE> -aet NOTREGISTERED. If it is accepted, the archive is exposed.

## Fix

Upgrade dcm4chee-arc-light to 5.35.2 or later. Until then, keep DICOM ports off the internet, behind firewalls and VPNs, and allow only known peers.

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105279
- 2026-10-23T23:32:30+00:00 analyst — CISA ICSMA-26-288-02 names J4Care dcm4chee-arc-light 5.35.1, fixed 5.35.2. No public exploitation or PoC reported per CISA. Did not find J4Care's own advisory or the config setting for the AE allow-list. Social search skipped.

## Documents

- [advisory] CISA ICSMA-26-288-02 J4Care dcm4che https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02
- [mentions] OpenCVE CVE-2026-105279 https://app.opencve.io/cve/CVE-2026-105279

## From the sources

In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_