dcm4chee-arc-light CVE-2026-97851

Exploitation requires the attacker to be able to invoke the storage status-change REST service of dcm4chee-arc-light and set a location record that is still associated with existing DICOM instances to a deletion-related state (specifically TO_DELETE); the destructive purge is then carried out automatically by the PurgeStorageScheduler background job. Per the CVSS vector (PR:N/UI:N) no authentication or user interaction is modeled, so the primary limiting factor is network reachability of the REST API - deployments that restrict the dcm4chee-arc management/REST interface to an internal/segmented network or place it behind authentication substantially reduce exposure. No special product feature toggle beyond the normal status-change service and the storage purge scheduler is needed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with high integrity (VI:H) and high availability (VA:H) impact and no confidentiality impact (VC:N), consistent with CWE-862 (Missing Authorization): the storage status-change REST service performs a privileged state transition without verifying the caller is authorized or that the location is safe to purge. This is a genuine high-priority issue for affected deployments because it enables silent, irreversible data destruction of medical imaging objects by any party who can reach the API, with no privileges or user interaction. However, no EPSS probability, no CISA KEV listing, and no public POC were supplied in the input, so there is no evidence of active or widespread exploitation to corroborate the high base score - the severity is driven by impact and ease of access, not by observed in-the-wild activity. One signal to verify: PR:N implies the REST endpoint is exposed without authentication, but production dcm4chee-arc-light instances are frequently deployed behind authentication/network segmentation, so the realistic PR:N assumption should be confirmed against the specific deployment before treating this as fully unauthenticated.

An attacker with network access to the dcm4chee-arc-light storage status-change REST endpoint sends a request setting a location record that is still linked to live DICOM instances to the TO_DELETE state. On the next run of PurgeStorageScheduler, the referenced imaging object is purged from storage while the instance record remains in the database, producing dangling references and permanent loss of patient imaging data. No public exploit code was identified at time of analysis, but exploitation requires only a single crafted REST call given the low attack complexity.