CVE-2026-105279 J4Care CVE debrief

Who should care

Healthcare organizations and medical institutions using J4Care dcm4chee-arc-light should assess their exposure and prioritize remediation efforts. This includes reviewing affected versions, implementing compensating controls, and monitoring for suspicious activity. The vulnerability's impact on patient care and confidentiality necessitates prompt attention and action from affected parties.

Why it matters

This critical vulnerability in J4Care dcm4chee-arc-light allows remote peers to access sensitive patient information and medical images without authentication, posing significant risks to healthcare organizations and medical institutions.

• Potential unauthorized access to sensitive patient information
• Possible disruption of medical services due to enumeration and retrieval of medical images
• Need for verification of affected versions and remediation status
• Potential impact on patient care and confidentiality

Technical summary

The J4Care dcm4chee-arc-light product is vulnerable to missing authentication for critical functions, allowing remote peers to enumerate and retrieve patient information and medical images without authentication. This vulnerability stems from the product's default configuration, which accepts DICOM associations from unregistered calling AE. The issue impacts healthcare organizations and medical institutions, potentially leading to unauthorized access to sensitive patient information and disruption of medical services.

Defensive priority

High

Recommended defensive actions

• Review and update affected versions to 5.35.2 or later
• Implement authentication for DICOM associations
• Monitor for suspicious activity and potential exploitation
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and source item provide details on the vulnerability, but limited information is available on affected versions and remediation. To verify exposure, defenders should review the official advisory, assess their product deployments, and monitor for suspicious activity. The lack of authentication for critical functions in J4Care dcm4chee-arc-light poses significant risks, and organizations should implement compensating controls while awaiting remediation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.