Live › vulnerability › CVE-2026-105667
Go to dashboardJ4Care dcm4chee-arc-light 5.35.1 (open-source DICOM/PACS archive). In the default configuration the HL7 listener (ports 2575 and 12575 TLS) accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and workflow records between patients, and the archive's unmerge does not undo it. One of six CVEs in CISA ICSMA-26-288-02. No known exploitation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| dcm4chee-arc-light | vendor | 5.35.1 | 5.35.2 |
5.35.1 is affectedValidate Sending HL7 Application Hostname (hl7ValidateSendingApplicationHostname) is set and the sending apps are listed with their connections5.35.2 or later (Docker tag dcm4che/dcm4chee-arc-psql:5.35.2)Validate Sending HL7 Application Hostname at Archive Device or HL7 Application level and register only the legitimate sending applications and hostsEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.
This page as .md · .json · in your agent: get_signal("CVE-2026-105667")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.