Our takeCISA reports active exploitation in J4Care dcm4che allowing attackers to delete medical images, disclose patient data, inject forged studies, reassign records, overwrite files, or DoS. Update affected versions now if you run it.Security Resilience desk
Sources (2)
- cisa_advisories · cisa_advisories
- auscert_bulletins · auscert_bulletins
What this means for you — Security leader:If you run J4Care dcm4che (dcm4chee-arc-light 5.35.1 or earlier) in any clinical environment, update immediately; CISA reports these flaws are under active exploitation and can let attackers delete images, leak PHI, forge studies, or cause DoS.
What this means for you — Lean IT orgs:If your clinic or small practice uses J4Care dcm4che for medical imaging, check the version today and update past 5.35.1; these flaws let attackers delete images or steal patient data and are already being used in the wild.
What this means for you — MSP:Check every client running J4Care dcm4che or dcm4chee-arc-light; CISA states versions ≤5.35.1 are under active exploitation allowing image deletion, PHI disclosure, and DoS — patch or isolate immediately where found.
What this means for you — Researcher:CISA advisory ICSMA-26-288-02 confirms active exploitation of multiple high-severity flaws in J4Care dcm4che ≤5.35.1 that can delete medical images, disclose PHI, inject forged studies, reassign records, or trigger DoS.