CVE-2026-97851
9.1CriticalPublished 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on integrity, availability
- Weakness
- CWE-862
Impact
Remote, unauthenticated attackers can delete stored DICOM medical imaging files and corrupt system integrity via network requests. This triggers background deletion of storage objects while leaving orphaned records in the database.
Root cause
The storage status-change REST endpoint lacks missing authorization checks (CWE-862), letting callers flag active DICOM locations as TO_DELETE and causing PurgeStorageScheduler to purge the underlying files.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Fix & remediation
Apply vendor updates from CISA advisory ICSMA-26-288-02 once released; as an immediate mitigation, block or restrict network access to the storage status-change REST service endpoint.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.