how automated healthcare fails, how you'd know, and what to do at each tier — every claim sourced, reviewed continuously
CISA disclosed six vulnerabilities in the dcm4chee-arc-light medical imaging archive. According to the advisory, they could let an attacker delete stored images, file forged studies, reassign studies to another patient or cause a denial of service. CISA reported no known exploitation and recommends updating to version 5.35.2 or later.
TierThis is a vulnerability disclosure with no reported exploitation, and no disruption of care is documented. How tiers are assigned.
On 15 October 2026 CISA published medical advisory ICSMA-26-288-02, which describes six vulnerabilities in J4Care dcm4chee-arc-light 5.35.1. The highest CVSS v3.1 score is 9.1. According to CISA, a REST service for changing storage status lets location records linked to DICOM instances be set to deletion states, which deletes the referenced objects from storage. The default configuration accepts DICOM associations from unregistered calling AEs, which allows retrieval of patient data and images and filing of fabricated studies. The default HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sender, so studies can be reassigned to another patient, and an unmerge does not reverse this. Three parsing flaws, in the JPEG, MP4 and multipart input handlers, can cause denial of service. CISA said no known public exploitation had been reported to it. It credited researcher Abhinav Agarwal and recommended upgrading to 5.35.2 or later and keeping imaging systems off the internet, behind firewalls. J4Care's release notes for version 5.35.2 on GitHub, dated 15 October, list security fixes for mass deletion of stored objects through an unrestricted storage status change and for the three parsing denial-of-service issues. The release notes do not mention the calling-AE or HL7 merge findings.[1,2]
none documented
Information only, not advice. FailSystems is an aggregation and synthesis of published sources. It is not consulting, engineering, legal, regulatory or medical advice, and using it creates no professional relationship. Health systems are complex and no approach fits every organisation: anything you adopt is your own decision, at your own risk, and should be checked against the current official sources and by qualified people who know your setting. Full disclaimer.