CVE-2026-97851: J4Care dcm4chee-arc-light (pending)
noindex and left out of the sitemap until more data is confirmed.CVE-2026-97851 is a missing-authorization flaw in J4Care's dcm4chee-arc-light open-source DICOM image archive that lets an attacker trigger deletion of stored medical-image objects whose database records are left intact, corrupting the archive's integrity; NVD has not yet completed its own CVSS scoring or CPE analysis, so this page is held as noindex until that analysis is published.
Vulnerability summary
| Vulnerability ID | CVE-2026-97851 |
|---|---|
| CVSS score | Not yet scored by NVD |
| EPSS score | 0.00318 |
| CISA KEV | No |
| Source | NVD |
| Published | 2026-10-16T15:17:38.490 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| J4Care dcm4chee-arc-light | — | 5.35.1 (fixed in 5.35.2); not yet a published NVD CPE applicability statement |
What this means
CVE-2026-97851 (CWE-862, missing authorization) affects dcm4chee-arc-light, J4Care's open-source DICOM (medical imaging) archive used by radiology and other imaging departments. NVD's description, submitted by the ICS-CERT coordinator, states "the storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states," and that "changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database" — leaving the archive's metadata pointing at image files that no longer exist (NVD).
NVD tracks the CVE with status "Deferred" as of 2026-10-21: it records the submitter's CVSS v3.1 score of 9.1 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H, and a CVSS v4.0 score of 8.8 (high), vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N, but has not published its own independent score or a CPE applicability statement, so this page leaves cvss_score unset rather than presenting the submitted figures as NVD-confirmed (NVD).
CISA's corresponding ICS Medical Advisory, released 2026-10-15, confirms dcm4chee-arc-light 5.35.1 is affected and fixed in 5.35.2, credits researcher Abhinav Agarwal with the report, and discloses five further related flaws in the same release — two infinite-loop denial-of-service bugs, an inefficient-algorithmic-complexity bug, and two missing-authentication bugs — all fixed in the same 5.35.2 update (CISA ICS Medical Advisory ICSMA-26-288-02).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-21, and FIRST scores the probability of exploitation at 0.00318 (23.389th percentile) (CISA KEV, FIRST EPSS).
Because NVD has not finished its own severity and applicability analysis, this page does not yet meet the minimum data bar for indexing and will be revisited once that analysis is published. In the meantime, dcm4chee-arc-light operators should update to 5.35.2 or later, which also addresses the five related CVEs disclosed in the same advisory.
Evidence
- Missing authorization on the storage status-change REST service lets an attacker move a location record to TO_DELETE, causing PurgeStorageScheduler to delete the stored object while its instance record remains in the database (CWE-862). — NVD
- NVD status is "Deferred" with submitter-reported CVSS v3.1 9.1 (critical) and CVSS v4.0 8.8 (high); no NVD-published score or CPE configuration as of 2026-10-21. — NVD
- Affects dcm4chee-arc-light 5.35.1, fixed in 5.35.2; reported by Abhinav Agarwal; same advisory discloses 5 related CVEs fixed in the same release. — CISA ICS Medical Advisory ICSMA-26-288-02
- Not present in the CISA KEV catalog as of 2026-10-21. — CISA KEV
- EPSS score is 0.00318 (23.389th percentile) as of 2026-10-21. — FIRST EPSS