CVE-2026-105279
Received Received - Intake

DICOM Archive Unauthenticated Data Access Vulnerability

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: ICS-CERT

Description
In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-105279
EUVD
EUVD-2026-102894

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
J4Care dcm4chee-arc-light 5.35.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows unauthorized access to a DICOM archive system. In its default setup, the system accepts connections from unknown sources without verification. Attackers can exploit this to query and retrieve patient data or medical images using DICOM commands like C-FIND and C-GET. They can also store fake study data linked to existing patient identities.

Detection Guidance

To detect this vulnerability, monitor network traffic for DICOM association requests from unregistered calling AE titles. Use tools like Wireshark to filter for DICOM protocol traffic (port 104 or 11112) and inspect C-FIND, C-GET, and C-STORE commands. Check DICOM server logs for unauthorized access attempts or unusual queries.

Impact Analysis

If you use this DICOM archive system, attackers could steal sensitive patient information, including medical images and records. They might also inject false data into the system, leading to incorrect diagnoses or treatment decisions. The high CVSS score indicates a severe risk of unauthorized access and data manipulation.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to protected health information. GDPR requires strict data protection, and HIPAA mandates safeguards for patient data. A breach could result in legal penalties, fines, and reputational damage for organizations handling medical data.

Mitigation Strategies

Disable DICOM associations from unregistered calling AE in the archive configuration. Restrict network access to the DICOM service using firewalls. Monitor for unauthorized C-FIND, C-GET, or C-STORE requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105279. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart