{"id":"CVE-2026-97851","kind":"vulnerability","aliases":["CVE-2026-97851"],"related":[],"title":"The storage status-change REST service allows location records still associated with DICOM instances to be changed…","description":"The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.","summary":"dcm4chee-arc-light's storage status-change REST service has no authorization check (CWE-862). An unauthenticated network caller can set a location still tied to a DICOM instance to TO_DELETE. PurgeStorageScheduler then deletes the stored object while the database record remains, so medical images are lost. Reported to CISA by Abhinav Agarwal. Five other dcm4chee-arc-light CVEs are in the same advisory.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dcm4chee-arc-light","fixed":["5.35.2"],"affected":"5.35.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["dcm4chee","dicom","healthcare","medical-imaging","other","self-hosted"],"not_affected_if":["not-running-dcm4chee-arc-light","rest-api-not-network-reachable","unknown","version-5.35.2-or-later"],"how_to_check":"Check the dcm4chee-arc-light version (UI/about page or deployed WAR/image tag). 5.35.1 is affected. Also check whether the archive REST API is reachable from untrusted networks without authentication.","fix":"Upgrade dcm4chee-arc-light to 5.35.2 or later (J4Care recommendation). Until then, restrict network access to the archive REST API and enable authentication in front of it.","status":"open","published_at":"2026-10-16T15:17:38+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-23T22:13:38+00:00","updated_at":"2026-10-23T23:32:05+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T22:13:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","impact":"high","summary":"A REST endpoint for changing storage location status lets a caller mark locations still tied to DICOM instances as deletion-pending. The purge scheduler then deletes those stored objects while the database still references them.","category":"other","who_cares":["dicom","medical-imaging"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Stored DICOM objects get deleted by the purge scheduler, causing data loss","analyst_note":"Identify the affected product and vendor from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-97851, then find the patched version and whether the REST endpoint requires authentication.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000435,"input_tokens":2751,"output_tokens":319,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Identify the affected product and vendor from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-97851, then find the patched version and whether the REST endpoint requires authentication.","search":"'-2026':20A,23A '-862':55B '-97851':21A,24A 'abhinav':93B 'advisori':106B 'agarw':94B 'allow':8A,114C 'arc':27A,41B,99B 'associ':12A,118C 'author':52B 'caller':59B 'caus':136C 'chang':5A,18A,47B,111C,124C,130C 'check':53B 'cisa':91B 'correspond':148C 'cve':19A,22A 'cves':101B 'cwe':54B 'databas':81B,154C 'dcm4chee':26A,29B,40B,98B 'dcm4chee-arc-light':25A,39B,97B 'delet':72B,75B,127C,135C,139C 'deletion-rel':126C 'dicom':14A,30B,68B,120C 'even':145C 'five':95B 'healthcar':31B 'host':38B 'imag':34B,86B 'instanc':15A,69B,121C,149C 'light':28A,42B,100B 'locat':9A,63B,115C,132C 'lost':88B 'medic':33B,85B 'medical-imag':32B 'network':58B 'object':78B,142C 'purgestorageschedul':73B,137C 'record':10A,82B,116C,150C 'referenc':141C 'relat':128C 'remain':83B,151C 'report':89B 'rest':6A,48B,112C 'self':37B 'self-host':36B 'servic':7A,49B,113C 'set':61B 'state':129C 'status':4A,46B,110C 'status-chang':3A,45B,109C 'still':11A,64B,117C 'storag':2A,44B,108C,144C 'store':77B 'though':146C 'tie':65B 'unauthent':57B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T15:17:38+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97851","severity":null,"published_at":"2026-10-16T15:17:38+00:00","modified_at":"2026-10-16T20:04:29+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97851:463","url":null,"severity":null,"published_at":"2026-10-23T23:32:05+00:00","modified_at":"2026-10-23T23:32:05+00:00","first_seen_at":"2026-10-23T23:32:05+00:00","fetched_at":"2026-10-23T23:32:05+00:00","note":"Product is J4Care dcm4chee-arc-light 5.35.1; fixed in 5.35.2 per CISA ICSMA-26-288-02 and CVE record. No auth needed per CVSS (PR:N, CWE-862) and ionix summary; vendor advisory not read directly. No exploitation or PoC found; social search skipped."}],"documents":[{"id":2029,"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02","title":"CISA ICSMA-26-288-02 J4Care dcm4che","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2030,"url":"https://www.cve.org/CVERecord?id=CVE-2026-97851","title":"CVE Record CVE-2026-97851","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}