J4Care dcm4che
Multiple critical vulnerabilities found in J4Care dcm4chee-arc-light medical imaging software.
Run J4Care?
Get an email when a reviewed story names J4Care, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Several critical vulnerabilities have been identified in J4Care dcm4chee-arc-light, a medical imaging software used worldwide in the healthcare sector. Exploitation could lead to the deletion or modification of patient data, disclosure of sensitive information, and denial-of-service conditions. J4Care has released a fix, recommending users update to version 5.35.2 or later.
The lesson from this incident
Full lessonMultiple critical vulnerabilities in J4Care dcm4chee-arc-light expose healthcare organizations to serious risks including patient data deletion, modification, unauthorized disclosure, and denial-of-service attacks. Medical imaging systems are high-value targets because they store sensitive protected health information (PHI) and are often deeply integrated into clinical workflows, making downtime or data loss life-threatening in nature. The availability of a vendor-supplied fix (version 5.35.2) makes timely patching a straightforward but urgent priority. Delayed remediation in healthcare environments—often justified by operational continuity concerns—significantly widens the attack window and increases regulatory exposure under frameworks like HIPAA.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
- cve — CVE-2026-97851
- cve — CVE-2026-107621
- cve — CVE-2026-105273
- cve — CVE-2026-101021
- cve — CVE-2026-105279
- cve — CVE-2026-105667