Blue Goat analysis
Scored with Blue Goat's medical device cybersecurity risk methodology: STRIDE classification and CVSS v4.0 exploitability, with a severity-of-harm readout for your own ISO 14971 hazard analysis.
The dcm4chee-arc-light archive is an open-source PACS used to store and serve medical images. CISA's advisory covers six vulnerabilities in version 5.35.1. Two of them go beyond data exposure: they let an unauthenticated attacker change which patient a study belongs to.
| CVE | What an attacker can do | STRIDE | CVSS v4.0 Exploitability | Security impact |
|---|---|---|---|---|
| CVE-2026-105667 | In the default configuration, the HL7 listener accepts patient-merge messages (ADT^A40) without authenticating the sender, so a remote sender can reassign studies and related workflow records (CWE-306) | Spoofing, Tampering | High | High |
| CVE-2026-105279 | In the default configuration, the archive accepts DICOM associations from unregistered callers, who can retrieve patient information and images, and file fabricated study content under an existing patient identity (CWE-306) | Spoofing, Tampering, Information disclosure | High | High |
| CVE-2026-97851 | A storage REST service lets locations still holding DICOM instances be moved to deletion states. The purge scheduler then deletes the stored object while the database still lists the instance (CWE-862) | Tampering, Denial of service | High | High |
| CVE-2026-107621 | A crafted or truncated JPEG stream can put the parser into an infinite loop (CWE-835) | Denial of service | High | High |
| CVE-2026-105273 | A malformed MP4 box can stall parsing indefinitely (CWE-835) | Denial of service | High | High |
| CVE-2026-101021 | Crafted multipart input forces excessive processing (CWE-407) | Denial of service | High | High |
All six published vectors are network-reachable with no privileges and no user action, so Exploitability reads High. Each has at least one High impact. On Blue Goat's security matrix, all six are Critical as published.
The published vectors describe the software, not your device. If the service is reachable only on a segmented clinical network or behind authentication, score your own deployment with the CVSS v4.0 environmental metrics before you rate your risk.
| Severity from your hazard analysis | Safety risk at High exploitability |
|---|---|
| Negligible | Medium |
| Minor or Serious | High |
| Critical or Catastrophic | Very High |
The two default-configuration flaws matter most clinically. A study filed under the wrong patient, or fabricated content attached to a real one, puts incorrect data in front of a clinician. The purge flaw can leave the archive listing images that no longer exist.
What to check now
- Search your SBOM for dcm4chee-arc-light 5.35.1, or any product built on it.
- Check your configuration against the two default-configuration flaws: whether unregistered calling AE titles are accepted, and whether the HL7 listener authenticates senders.
- Update to release 5.35.2 or later, which J4Care recommends.
- If you're not affected, record that in a VEX statement with the justification.
- Re-score each affected threat, and carry patient-harm results into your ISO 14971 file.
This analysis is informational. It is based on CISA's published advisory and does not assess any specific manufacturer's device.
Related Goat Feed analysis
Other items reviewed by the Blue Goat team.