CVE-2026-105279
9.1CriticalPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-306
Impact
Unauthenticated remote attackers can query, download, and overwrite patient medical records and imaging. All they need is network access to the DICOM service port.
Root cause
The archive defaults to missing authentication (CWE-306), accepting DICOM associations from any unregistered calling Application Entity.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Refer to CISA advisory icsma-26-288-02 for target patch versions; as an immediate mitigation, reconfigure the archive to reject associations from unknown/unregistered AE titles and restrict access to the DICOM port at the network firewall.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.