CVE-2026-97851 J4Care CVE debrief

Who should care

Defenders responsible for J4Care dcm4che deployments should assess exposure and prioritize remediation based on the severity of the vulnerability and the potential operational impacts. This includes reviewing and restricting access to the storage status-change REST service, verifying and applying vendor-provided patches or updates, and monitoring for suspicious activity related to object deletion. Additionally, defenders should verify affected versions and

Why it matters

The vulnerability allows unauthorized changes to location records, potentially leading to object deletion from storage. Defenders responsible for J4Care dcm4che deployments should assess exposure and prioritize remediation.

• Potential unauthorized object deletion from storage
• Possible data loss or corruption
• Required verification of affected versions and remediation

Technical summary

The storage status-change REST service in J4Care dcm4che allows location records still associated with DICOM instances to be changed to deletion-related states, potentially leading to object deletion from storage. This vulnerability affects J4Care dcm4che deployments, which may be exposed to unauthorized data modifications. The vulnerability allows unauthorized changes to location records, potentially leading to object deletion from storage. Defenders should assess the impact and prioritize remediation based on the severity of the vulnerability and the potential operational impacts.

Defensive priority

High

Recommended defensive actions

• Review and restrict access to the storage status-change REST service
• Verify and apply vendor-provided patches or updates
• Monitor for suspicious activity related to object deletion
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability. However, additional information from official sources is required to fully assess the impact and remediation. The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states, potentially leading to object deletion from storage. Defenders should verify affected versions and apply vendor-provided patches or updates.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.