- CISA says six flaws in J4Care's dcm4chee-arc-light 5.35.1 could let an attacker delete images, inject forged studies, reassign patient records or disrupt service.
- The editorial point: in healthcare, altered records can do more harm than stolen ones, because clinicians trust what the system shows them.
- J4Care recommends release 5.35.2 or later. CISA reports no known public exploitation. Teams should confirm their version and who can reach the system.
The risk is a wrong record, not only a leaked one
Much healthcare security coverage focuses on whether patient data leaked. A new CISA advisory raises a harder question. Can someone change what a clinician sees?
The advisory concerns J4Care's dcm4chee-arc-light. The list of outcomes shows what it holds: stored medical images, imaging studies and patient records. Clinicians make care decisions from that kind of material, so they have to trust it.
CISA says an attacker who exploits these flaws could delete stored medical images. The attacker could also read patient information. The advisory adds two more outcomes: forged studies and reassigned patient records. Those two are not theft. They change the record itself.
This is the editorial point. A stolen file is a privacy problem, and you can measure it. A forged or misfiled image is a trust problem. The person reading it has no reason to doubt it.
What CISA reported
CISA published advisory ICSMA-26-288-02 on October 15, 2026. It covers version 5.35.1 of dcm4chee-arc-light. CISA places the product in the Healthcare and Public Health sector.
The advisory ties six CVE IDs to that version. The first three are CVE-2026-97851, CVE-2026-107621 and CVE-2026-105273. The other three are CVE-2026-101021, CVE-2026-105279 and CVE-2026-105667. Add all six to your tracking.
Abhinav Agarwal reported the flaws to CISA. J4Care has built a fix. It recommends release 5.35.2 or later.
How the weaknesses work
The advisory lists outcomes that touch stored images, imaging studies and patient records. People make care decisions from those records. That is why the outcomes matter.
CISA sorts the flaws into four weakness types. Two of them bear on record integrity.
The first is missing authentication for a critical function (CWE-306). A feature that changes important data never asks who is calling it. The second is missing authorization (CWE-862). The system knows the caller but does not check what that person may do.
Weaknesses like these can allow deleted images, reassigned records or injected studies. CISA does not say which CVE causes which outcome. Treat the link as a likely fit, not a confirmed map.
The other two types point to service disruption. An infinite loop (CWE-835) is code that gets stuck repeating. Inefficient algorithmic complexity (CWE-407) means some input makes software do far more work than it should. CISA lists denial of service among the outcomes. That means the system becomes unavailable.
What is known, and what is not
CISA says it has received no reports of public exploitation aimed at these flaws. That covers reports so far. It does not prove that nobody has tried.
The advisory names 5.35.1 as the affected version. Ask J4Care whether earlier releases are affected.
The material we reviewed has no severity scores or attack-path details. Read the full advisory and the CVE records before you rank this work.
Questions to put to your team
First, do we run dcm4chee-arc-light anywhere? It may sit inside a vendor's imaging product. If so, which version? Ask vendors directly.
Second, who can reach it? The advisory repeats CISA's general advice for control systems, which is not written for this product. It says to keep such devices off the internet and behind firewalls, away from business networks. If you need remote access, use a VPN and keep it updated. CISA notes a VPN is only as secure as the devices connected to it.
Third, if someone altered images or patient assignments, how would we know? Ask whether the system logs who changed or deleted records. Ask whether anyone reviews those logs. Ask whether images can be checked against a second copy.
Fourth, who owns the upgrade to 5.35.2, and by what date? CISA asks organizations to run an impact analysis and risk assessment before they deploy defenses. Test the change before it goes live.
The lesson
Security teams measure confidentiality because leaks are easy to see. This advisory is a reminder to measure integrity too. Losing availability is serious, but staff notice it quickly. A record that may have been changed, with no visible mark, can go unnoticed and wear down the trust clinicians place in it.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: CISA.
