CISA Identifies Security Flaws in J4Care Imaging Software
Multiple vulnerabilities in the dcm4chee platform allow unauthorized access to patient images and data.
Updated on Oct. 15, 2026 in Cybersecurity
Live Poll
Do you trust that medical institutions in your area adequately protect patient records from cyberattacks?
CISA has issued a security advisory for J4Care dcm4chee-arc-light version 5.35.1, highlighting multiple vulnerabilities in the software. These flaws allow unauthorized parties to delete medical images, disclose sensitive patient information, or execute a denial-of-service attack.
Why it matters
The software is a central component for managing medical imaging records, and these flaws could allow attackers to inject forged studies or overwrite legitimate patient data. Securing this infrastructure is critical for maintaining clinical data integrity and system availability.
CISA has identified 6 distinct CVE vulnerabilities affecting dcm4chee-arc-light version 5.35.1. While technical details remain limited, the flaws permit operations ranging from record reassignment to complete denial-of-service, though no public exploitation has been confirmed.
The players
CISA
The Cybersecurity and Infrastructure Security Agency is the lead U.S. federal agency responsible for protecting the nation's critical infrastructure and digital systems.
J4Care
An Austrian software company that specializes in medical imaging solutions, primarily managing the dcm4chee open-source enterprise archive platform.
The details
Exploitation of these vulnerabilities allows for unauthorized manipulation of the digital imaging environment, specifically by reassigning records or overwriting existing files with forged data. CISA advises administrators to secure installations by ensuring all devices are placed behind firewalls and isolated from general business networks to minimize exposure. These measures act to decouple the medical image management system from the broader internet and internal enterprise traffic.
Timeline
- 2026-10-15
CISA released the security advisory regarding J4Care software.
The Tech Race
This vulnerability disclosure reflects a broader, ongoing effort by CISA to secure specialized medical and industrial software architectures against remote threats. It aligns with standard mitigation protocols for protecting critical data infrastructure that was historically air-gapped but is increasingly integrated into wider enterprise networks.
Healthcare facility IT administrators using version 5.35.1 must immediately ensure their systems are isolated behind firewalls. This action is necessary to prevent potential remote exploitation until official vendor patches are deployed.
The takeaway
The identified flaws underscore the high stakes of securing medical archives against unauthorized record manipulation. Administrators should prioritize network isolation and monitor CISA advisories for future patch releases to secure affected version 5.35.1 deployments.
Further reading
For broader trends in medical software safety, see our reporting on Cybersecurity.
More information
Review technical guidance on the CISA control systems security webpage.
Source note: This article includes information reported by Cisa.
Live Poll
Do you trust that medical institutions in your area adequately protect patient records from cyberattacks?
