[ CVE-2026-105667 · Published 16 Oct 2026 ]
Vulnerability in J4Care dcm4chee-arc-light
CVSS 7.5
EPSS <1%No fix listed yet
[ Description ]Official description
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.