Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2026-105279

J4Care dcm4che Missing Authentication for Critical Function

Description

In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

J4Care dcm4chee-arc-light

Default version status: unaffected

  • 5.35.1affected
  • 5.35.2unaffected

References