CVE-2026-105279

validated

EUVD-2026-102894 ↗

check availablenot proven exploitable

cve.orgpublic pockev

J4Care dcm4chee-arc-light 5.35.1

CWE-306 Missing Authentication for Critical Function

ETK-2026-1783, permanent identifier

cvss9.3cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

+1h30mTTV

1h 05mAI analysis

Check if you are vulnerable

timeline

0 = cve.org publication

trigger signal (cve.org) +0mcheck available+90magent stopped

+30min

+60min

description

dcm4chee-arc-light deployments using the default association configuration may accept connections from unregistered DICOM calling AEs. A remote peer that can reach the archive can enumerate and retrieve patient information and images, and may submit fabricated study content under an existing patient identity.

mitigation

Configure the archive to accept DICOM associations only from registered and authorized calling AEs. Restrict network access to the DICOM service to trusted peers until the configuration has been reviewed.

check

available

exploit

automation

deterministic

auth required

EPSS

0.24%14th percentile

agent run time

1h 05m

cve.org record, t = 0

2026-10-16 14:30Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual check: a technique exists and was validated, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-16 14:30Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-105279

this entry in the feed

GET /api/v1/feed/CVE-2026-105279

{
  "etk_id": "ETK-2026-1783",
  "cve_id": "CVE-2026-105279",
  "display_id": "CVE-2026-105279",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-102894",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing association authentication in dcm4chee-arc-light",
  "summary": "dcm4chee-arc-light deployments using the default association configuration may accept connections from unregistered DICOM calling AEs. A remote peer that can reach the archive can enumerate and retrieve patient information and images, and may submit fabricated study content under an existing patient identity.",
  "mitigation": "Configure the archive to accept DICOM associations only from registered and authorized calling AEs. Restrict network access to the DICOM service to trusted peers until the configuration has been reviewed.",
  "vendor": "J4Care",
  "product": "dcm4chee-arc-light",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "5.35.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "dcm4chee-arc-light",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 9.3,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0024,
  "epss_percentile": 0.1432,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 64.52551833333334,
  "t0_at": "2026-10-16T14:30:51.439000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-16T16:00:29.164211+00:00",
      "days": 0.06224218994212963,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T14:30:51.439000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-16T14:30:51.439000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T14:30:51.439000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105279"
    }
  }
}

published 2026-10-16 15:20Z
last change 2026-10-21 04:45Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.