Is CVE-2026-105667 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105667 being exploited in the wild.

How severe is CVE-2026-105667?

High severity, with a CVSS score of 7.5, published 16 October 2026.

Which products and versions are affected?

J4Care Dcm4chee-Arc-Light 5.35.1.

Is there a fix for CVE-2026-105667?

Yes: fixed in dcm4chee-arc-light 5.35.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-105667 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-105667?

Check whether you run J4Care Dcm4chee-Arc-Light at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105667: J4Care dcm4che HL7 listener missing authentication for patient merge

CVE-2026-105667 · Severity: high · CVSS 7.5 · Published 2026-10-16

J4Care dcm4che is a DICOM archive system used in healthcare facilities to store and manage medical images and patient data. The HL7 listener component accepts patient-merge messages without verifying the sender's identity, allowing a remote attacker to reassign medical studies and workflow records between patient identities, causing patient data to be associated with the wrong individuals with no reliable way to reverse the changes.

Technologies: J4Care Dcm4chee-Arc-Light. Vendors: J4Care.

Quick answers

Is CVE-2026-105667 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105667 being exploited in the wild.
How severe is CVE-2026-105667?: High severity, with a CVSS score of 7.5, published 16 October 2026.
Which products and versions are affected?: J4Care Dcm4chee-Arc-Light 5.35.1.
Is there a fix for CVE-2026-105667?: Yes: fixed in dcm4chee-arc-light 5.35.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105667 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-105667?: Check whether you run J4Care Dcm4chee-Arc-Light at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: dcm4chee-arc-light 5.35.2 or later

Technical details

The vulnerability is a missing authentication issue in the HL7 listener that processes ADT^A40 patient-merge messages in its default configuration. An unauthenticated remote attacker can send specially crafted messages over the network to reassign DICOM studies and related workflow records from one patient identity to another; the archive's unmerge function does not properly reverse these changes. This results in persistent data integrity compromise affecting patient record accuracy.

Affected products

J4Care dcm4chee-arc-light 5.35.1

Timeline

2026-10-15: disclosed
2026-10-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.