{"id":"CVE-2026-105667","kind":"vulnerability","aliases":["CVE-2026-105667"],"related":[],"title":"HL7 listener accepts unauthenticated patient-merge messages, reassigning records","description":"In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.","summary":"J4Care dcm4chee-arc-light 5.35.1 (open-source DICOM/PACS archive). In the default configuration the HL7 listener (ports 2575 and 12575 TLS) accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and workflow records between patients, and the archive's unmerge does not undo it. One of six CVEs in CISA ICSMA-26-288-02. No known exploitation.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dcm4chee-arc-light","fixed":["5.35.2"],"affected":"5.35.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["dcm4chee","dicom","healthcare-imaging","hl7","other","pacs","self-hosted"],"not_affected_if":["listener-restricted-to-trusted-senders","non-default-config","version-5.35.2-or-later"],"how_to_check":"Check the version: 5.35.1 is affected. In the archive UI go to Configuration > Devices > dcm4chee-arc > HL7 Applications, and check whether 'Validate Sending HL7 Application Hostname' (hl7ValidateSendingApplicationHostname) is set and the sending apps are listed with their connections. The default pre-configured '*' HL7 application accepts any sender. Check whether ports 2575 and 12575 are reachable from untrusted networks. Audit past ADT^A40 merges against the upstream registration system.","fix":"Upgrade to dcm4chee-arc-light 5.35.2 or later (Docker tag dcm4che/dcm4chee-arc-psql:5.35.2). Then enable 'Validate Sending HL7 Application Hostname' at Archive Device or HL7 Application level and register only the legitimate sending applications and hosts. Also restrict the HL7 ports to trusted senders at the network layer.","status":"open","published_at":"2026-10-16T15:17:04+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:39:06+00:00","updated_at":"2026-10-24T00:26:53+00:00","category":"other","confidence":0.75,"triage":{"at":"2026-10-23T22:39:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"HL7 listener accepts unauthenticated patient-merge messages, reassigning records","impact":"high","summary":"In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without checking the sending application. A remote sender can move studies and workflow records from one patient identity to another, and the archive's unmerge does not reverse it.","category":"other","who_cares":["hl7","healthcare-imaging","self-hosted"],"confidence":0.5,"needs_auth":"no","worst_case":"remote sender reassigns patient records between identities without authentication","analyst_note":"Identify the affected product and vendor from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-105667, then find the patched version and the setting that enables sender authentication on the HL7 listener.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["listener-restricted-to-trusted-senders","non-default-config"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.00048,"input_tokens":2893,"output_tokens":382,"severity_before":"high"},"analyst_status":"done","analyst_note":"Identify the affected product and vendor from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-105667, then find the patched version and the setting that enables sender authentication on the HL7 listener.","search":"'-02':96B '-105667':13A,16A '-2026':12A,15A '-26':94B '-288':95B '12575':53B '2575':51B '5.35.1':37B 'a40':57B,109C 'accept':3A,55B,107C 'adt':56B,108C 'anoth':134C 'applic':66B,118C 'arc':19A,35B 'archiv':42B,80B,136C 'authent':63B,115C 'cisa':92B 'configur':46B,103C 'cve':11A,14A 'cves':90B 'dcm4chee':18A,21B,34B 'dcm4chee-arc-light':17A,33B 'default':45B,102C 'dicom':22B 'dicom/pacs':41B 'exploit':99B 'healthcar':24B 'healthcare-imag':23B 'hl7':1A,26B,48B,105C 'host':31B 'icsma':93B 'ident':132C 'imag':25B 'j4care':32B 'known':98B 'light':20A,36B 'listen':2A,49B,106C 'merg':7A,60B,112C 'messag':8A,61B,113C 'one':87B,130C 'open':39B 'open-sourc':38B 'pac':28B 'patient':6A,59B,77B,111C,131C 'patient-merg':5A,58B,110C 'port':50B 'reassign':9A,71B,123C 'record':10A,75B,128C 'relat':126C 'remot':68B,120C 'revers':141C 'self':30B 'self-host':29B 'send':65B,117C 'sender':69B,121C 'six':89B 'sourc':40B 'studi':72B,124C 'tls':54B 'unauthent':4A 'undo':85B 'unmerg':82B,138C 'without':62B,114C 'workflow':74B,127C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T15:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105667","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105667","severity":null,"published_at":"2026-10-16T15:17:04+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105667:664","url":null,"severity":null,"published_at":"2026-10-24T00:26:53+00:00","modified_at":"2026-10-24T00:26:53+00:00","first_seen_at":"2026-10-24T00:26:53+00:00","fetched_at":"2026-10-24T00:26:53+00:00","note":"Product is J4Care dcm4chee-arc-light 5.35.1 (CISA ICSMA-26-288-02, CNA ICS-CERT); fix 5.35.2 per CISA. Setting hl7ValidateSendingApplicationHostname from release item #5066 is likely the control, but no source explicitly ties it to this CVE and the release notes do not list this CVE under Fixed Security Advisories; whether 5.35.2 turns it on by default is unknown. No exploitation or public PoC found (CISA says none); X has about 3 posts in 7 days, none saved."}],"documents":[{"id":2029,"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02","title":"CISA ICSMA-26-288-02 J4Care dcm4che","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2618,"url":"https://newreleases.io/project/github/dcm4che/dcm4chee-arc-light/release/5.35.2","title":"dcm4chee-arc-light 5.35.2 release notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":2619,"url":"https://github.com/dcm4che/dcm4chee-arc-light/issues/5066","title":"Validate Hostname or IP Address of Sending HL7 Application (#5066)","kind":"issue","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":2620,"url":"https://severitydaily.com/dcm4chee-arc-light-icsma-26-288-02-six-cves-unauthenticated-dicom-hl7-merge-not-reversible-5-35-2/","title":"Severity Daily: dcm4chee archive accepts unauthenticated DICOM and HL7 by default","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}