Is CVE-2026-105667 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-105667 being exploited in the wild.

How severe is CVE-2026-105667?

Critical severity, with a CVSS score of 9.1, published 16 October 2026.

Which products and versions are affected?

J4Care Dcm4chee-Arc-Light 5.35.1.

Is there a fix for CVE-2026-105667?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-105667 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-105667?

Check whether you run J4Care Dcm4chee-Arc-Light at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-105667: J4Care dcm4chee-arc-light multiple vulnerabilities

CVE-2026-105667 · Severity: critical · CVSS 9.1 · Published 2026-10-16

dcm4chee-arc-light is a medical imaging archive used in healthcare systems to store and manage DICOM patient images and records. Multiple vulnerabilities in this system could allow attackers to delete medical images, access patient information, inject fake studies, reassign patient records, and cause service outages, compromising patient care and data privacy in critical healthcare infrastructure.

Technologies: J4Care Dcm4chee-Arc-Light. Vendors: J4Care.

Quick answers

Is CVE-2026-105667 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-105667 being exploited in the wild.
How severe is CVE-2026-105667?: Critical severity, with a CVSS score of 9.1, published 16 October 2026.
Which products and versions are affected?: J4Care Dcm4chee-Arc-Light 5.35.1.
Is there a fix for CVE-2026-105667?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-105667 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-105667?: Check whether you run J4Care Dcm4chee-Arc-Light at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The affected version 5.35.1 contains missing authorization controls, missing authentication for critical functions, infinite loops causing denial of service, and inefficient algorithmic complexity issues. These flaws enable unauthenticated or inadequately authorized network attacks on the DICOM archive interface, allowing attackers to manipulate or delete stored medical data and patient records without proper authentication or authorization checks.

Affected products

J4Care dcm4chee-arc-light 5.35.1

Identifiers

CVE-2026-105667
CVE-2026-107621
CVE-2026-105279
CVE-2026-105273
CVE-2026-97851
CVE-2026-101021

Timeline

2026-10-15: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.