CVE-2026-105279

CVE-2026-105279 is a missing-authentication flaw (CWE-306) in the J4Care dcm4che DICOM archive. In the default configuration the archive accepts DICOM associations from an unregistered calling Application Entity, so a remote peer can issue C-FIND and C-GET to list and retrieve patient information and medical images, and C-STORE to file fabricated study content under an existing patient identity. No privileges or user interaction are required, and the issue is rated critical (CVSS 4.0 9.3) with high confidentiality and integrity impact and no availability impact. Operators of dcm4che archives that still use that default AE policy are affected; exact version ranges were not published in the data provided. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Treat unauthenticated DICOM access as a patient-data incident risk: stop accepting associations from unregistered calling AEs (require registered AE titles and, where available, TLS or other strong peer authentication), and do not expose the archive's DICOM ports to untrusted networks. Until a vendor fix is confirmed, segment the archive, review AE configuration and recent C-FIND, C-GET, and C-STORE activity for unexpected peers or studies, and apply the J4Care/dcm4che update as soon as a patched release is published.