CVE-2026-105667

waiting for further signals

EUVD-2026-102895 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

J4Care dcm4chee-arc-light 5.35.1

CWE-306 Missing Authentication for Critical Function

ETK-2026-1955, permanent identifier

cvss8.7cna vendorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

2d 07h 48msince last run

1h 14mAI analysis

timeline

0 = trigger signal

trigger signal (cve.org) +0hwaiting for further signals+71h17m

+2h

+4h

+6h

+8h

+10h

description

The default HL7 listener in dcm4chee-arc-light accepts patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records between patient identities; reversing a merge does not restore those changes.

mitigation

Configure the HL7 listener to authenticate sending applications. Restrict network access to the listener to trusted systems until that configuration is in place.

check

exploit

automation

contextual

auth required

EPSS

0.21%10th percentile

agent run time

1h 14m

cve.org record, t = 0

2026-10-16 14:32Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-16 14:32Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-105667

this entry in the feed

GET /api/v1/feed/CVE-2026-105667

{
  "etk_id": "ETK-2026-1955",
  "cve_id": "CVE-2026-105667",
  "display_id": "CVE-2026-105667",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-102895",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated HL7 patient merges in dcm4chee-arc-light",
  "summary": "The default HL7 listener in dcm4chee-arc-light accepts patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records between patient identities; reversing a merge does not restore those changes.",
  "mitigation": "Configure the HL7 listener to authenticate sending applications. Restrict network access to the listener to trusted systems until that configuration is in place.",
  "vendor": "J4Care",
  "product": "dcm4chee-arc-light",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "5.35.1"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "dcm4chee-arc-light",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 8.7,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": 0.0021,
  "epss_percentile": 0.1061,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 74.13641125,
  "t0_at": "2026-10-16T14:32:22.216000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-16T14:32:22.216000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-16T14:32:22.216000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105667"
    }
  }
}

published 2026-10-18 09:02Z
last change 2026-10-21 20:26Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.