# CVE-2026-105279: J4Care dcm4chee-arc-light DICOM authentication bypass

Source: https://junglewise.ai/threats/cve-2026-105279-in-the-default-configuration-the-archive-accepts-dicom  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-16. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-105279 · Severity: critical · CVSS 9.1 · Published 2026-10-16

J4Care dcm4chee-arc-light is a medical image archiving system used by healthcare organizations to store and manage patient imaging data. In its default configuration, it accepts connections from unregistered DICOM peers without authentication, allowing attackers to view and retrieve patient medical images, access sensitive patient information, and inject forged medical studies into patient records.

Technologies: [J4Care Dcm4chee-Arc-Light](https://junglewise.ai/threats/technologies/dcm4chee-arc-light). Vendors: [J4Care](https://junglewise.ai/threats/vendors/j4care).

## Quick answers

**Is CVE-2026-105279 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105279 being exploited in the wild.

**How severe is CVE-2026-105279?** Critical severity, with a CVSS score of 9.1, published 16 October 2026.

**Which products and versions are affected?** J4Care Dcm4chee-Arc-Light 5.35.1.

**Is there a fix for CVE-2026-105279?** Yes: fixed in dcm4chee-arc-light 5.35.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105279 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-105279?** Check whether you run J4Care Dcm4chee-Arc-Light at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in dcm4chee-arc-light 5.35.2 or later

## Technical details

The vulnerability is an authentication bypass in the DICOM association handling where the default configuration fails to validate the calling Application Entity (AE). An unauthenticated network attacker can exploit C-FIND and C-GET DICOM operations to enumerate and retrieve patient data and images, and use C-STORE to inject fabricated studies. This is a missing authentication vulnerability affecting the default configuration of version 5.35.1.

## Affected products

- J4Care dcm4chee-arc-light 5.35.1

## Timeline

- 2026-10-15: disclosed
- 2026-10-16: advisory

## References

- [https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json](https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json)
- [https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02)

## Related threats

- [J4Care dcm4chee-arc-light multiple vulnerabilities](https://junglewise.ai/threats/cve-2026-97851-j4care-dcm4che)
- [J4Care dcm4che JPEGParser infinite loop in JPEG parsing](https://junglewise.ai/threats/cve-2026-107621-jpegparser-can-enter-an-infinite-loop-while-parsing-a-specially)
- [J4Care dcm4che HL7 listener missing authentication for patient merge](https://junglewise.ai/threats/cve-2026-105667-in-the-default-configuration-the-hl7-listener-accepts-adt-a40)
- [J4Care dcm4chee-arc-light MP4Parser infinite loop in MP4 box parsing](https://junglewise.ai/threats/cve-2026-105273-mp4parser-does-not-adequately-validate-mp4-box-sizes-a-malformed)
- [J4Care dcm4chee-arc-light inefficient algorithmic complexity in multipart parsing](https://junglewise.ai/threats/cve-2026-101021-multipartinputstream-performs-inefficient-boundary-matching-and)