CVE-2026-101021

Six Critical Vulnerabilities Discovered in J4Care dcm4chee-arc-light Medical Imaging Platform

CISA and J4Care have disclosed six vulnerabilities affecting dcm4chee-arc-light version 5.35.1, a widely used medical imaging (DICOM) platform. The flaws span missing authorization, infinite loops in parsing libraries, and missing authentication for critical functions. Exploitation could allow attackers to delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files, and cause denial-of-service conditions. J4Care recommends upgrading to release 5.35.2 or later.