DCM4CHEE Arc Light CVE-2026-105667

Exploitation requires that the dcm4chee-arc-light HL7 listener be enabled in its default configuration, which accepts ADT^A40 patient-merge messages without authenticating the sending application; the attacker must have network access to that HL7/MLLP listener port and the ability to send a crafted ADT^A40 merge message. No credentials, user interaction, or non-default settings are needed - this is the default state. The primary limiting factor is network exposure: HL7/MLLP listeners are commonly deployed on segmented internal clinical networks, so real-world reachability depends on whether the listener is accessible to the attacker rather than on any application-level barrier.

This is a genuine, well-characterized integrity risk rather than inflated CVSS noise. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated exploitation requiring no user interaction, and the impact profile is unusually clean - VI:H with VC:N and VA:N - meaning this is a pure data-integrity flaw (CWE-306, missing authentication for a critical function), not a confidentiality or availability issue. The description corroborates the vector: the default-configured HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sender, and the irreversibility note ('the archive's unmerge does not reverse this') elevates the real-world severity because the integrity damage is persistent. Key signals are missing and should be stated plainly: no EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or automated exploitation - the 8.7 reflects intrinsic exploitability, not demonstrated attacks. The one tension between vector and reality is exposure: AV:N implies network reach, but HL7/MLLP listeners typically sit on segmented internal clinical networks, so practical reachability by an arbitrary remote attacker depends on network architecture - verify segmentation before treating this as internet-facing.

An attacker with network reach to the hospital's HL7/MLLP listener port sends a forged ADT^A40 (patient merge) message, which the default-configured dcm4chee-arc-light archive processes without verifying the sending application. Studies and workflow records are silently reassigned from one patient identity to another, and because the archive's unmerge does not reverse the operation, the corruption persists. No public exploit code is required - a standard HL7 message crafted with common tooling is sufficient given AV:N/AC:L/PR:N.