CVE-2026-97851 & 5 More Critical Flaws in dcm4chee-arc-light 5.35.1 — Healthcare Detection and Remediation Guide

---
title: Unauthenticated Destructive or Patient-Record Operation Against dcm4chee Archive
id: 3f9c1a72-6b44-4e58-9d21-7a2c5e8f0b31
status: experimental
description: Detects HTTP DELETE/PUT/POST requests to dcm4chee-arc REST endpoints associated with study deletion, patient reassignment, or record overwrite — operations that, per ICSMA-26-288-02, are exposed via missing authentication/authorization in dcm4chee-arc-light 5.35.1.
references:
  - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1485
  - attack.t1565
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri|contains:
      - '/dcm4chee-arc/aets/'
      - '/dcm4chee-arc/patients/'
      - '/dcm4chee-arc/queue/'
      - '/dcm4chee-arc/monitor/'
  selection_method:
    cs-method:
      - 'DELETE'
      - 'PUT'
      - 'POST'
  condition: selection_uri and selection_method
falsepositives:
  - Legitimate archive administration from authorized workstations — baseline admin source IPs and filter by c-ip
level: high
---
title: dcm4chee Archive Host Process Anomaly — Command Shell Spawned by Java/WildFly
id: 8b2e4d61-1a9f-4c37-b5e6-2d7f0a3c94e8
status: experimental
description: Detects the Java/WildFly process hosting dcm4chee-arc spawning shell or system utilities, consistent with post-exploitation activity on a compromised PACS archive server.
references:
  - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'java'
      - 'standalone.sh'
      - 'wildfly'
      - 'jboss'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; some WildFly management scripts invoke shells during startup — tune against known startup windows and init scripts
level: critical
---
title: Denial-of-Service Pattern — High-Volume Repeated Requests to dcm4chee Archive Endpoints
id: 5c7a9f23-4d18-4e60-a8b2-9f3e6d1c07a4
status: experimental
description: Detects sustained high-volume or repetitive requests from a single source to dcm4chee-arc endpoints, consistent with the infinite-loop (CWE-835) and algorithmic complexity (CWE-407) denial-of-service conditions described in ICSMA-26-288-02.
references:
  - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.impact
  - attack.t1499
logsource:
  category: webserver
detection:
  selection:
    cs-uri|contains:
      - '/dcm4chee-arc/'
  condition: selection | count(c-ip) by cs-uri > 500
falsepositives:
  - Bulk study migration or QA tooling — whitelist known migration source hosts and scheduled maintenance windows
level: medium

// Hunt: unauthenticated/destructive operations and DoS patterns against dcm4chee-arc
// Assumes archive web access logs or reverse proxy logs ingested via Syslog/CEF
let Lookback = 24h;
let ArchiveHosts = dynamic(["pacs", "dcm4chee", "dicom", "arc-light"]);
union isfuzzy=true
    (CommonSecurityLog
    | where TimeGenerated >= Lookback
    | where DeviceVendor =~ "Apache" or DeviceVendor =~ "nginx" or DeviceCustomString1 has_any (ArchiveHosts)
    | where RequestURL has_any ("/dcm4chee-arc/aets/", "/dcm4chee-arc/patients/", "/dcm4chee-arc/queue/")
    | where RequestMethod in~ ("DELETE", "PUT", "POST")
    | project TimeGenerated, SourceIP, RequestMethod, RequestURL, DeviceCustomString1, _ResourceId),
    (Syslog
    | where TimeGenerated >= Lookback
    | where SyslogMessage has_any ("/dcm4chee-arc/aets/", "/dcm4chee-arc/patients/", "/dcm4chee-arc/queue/")
    | where SyslogMessage has_any ("DELETE", "PUT", "POST")
    | extend RequestSource = extract(@'(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)
    | project TimeGenerated, Computer, RequestSource, SyslogMessage)
| summarize Operations = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by SourceIP = coalesce(SourceIP, RequestSource), RequestURL
| where Operations > 5   // any meaningful volume of destructive ops from one source warrants review
| sort by Operations desc;

// Hunt: request-volume anomaly per source against the archive (DoS via CWE-835 / CWE-407)
Syslog
| where TimeGenerated >= 6h
| where SyslogMessage has "/dcm4chee-arc/"
| extend SourceIP = extract(@'(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})', 1, SyslogMessage)
| summarize Requests = count(), DistinctEndpoints = dcount(extract(@'(/dcm4chee-arc/[^ \"]*)', 1, SyslogMessage)) by SourceIP, bin(TimeGenerated, 5m)
| where Requests > 1000
| sort by Requests desc;

-- Hunt the dcm4chee archive host: unexpected child processes of Java/WildFly
-- and inbound connections to DICOM/web listeners from non-clinical subnets
LET proc_hunt = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE (Exe =~ 'java' OR CommandLine =~ 'wildfly|jboss|dcm4chee')
   OR (Name =~ 'sh|bash|curl|wget|nc|python' AND Ppid IN (
        SELECT Pid FROM pslist() WHERE Exe =~ 'java'))

LET net_hunt = SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE LocalPort IN (11112, 2762, 8080, 8443, 9990)
   AND Status =~ 'ESTABLISHED|LISTEN'

SELECT * FROM proc_hunt
UNION ALL
SELECT Pid, Ppid=NULL, Name, Exe=NULL,
       CommandLine=format(format='%v:%v <- %v:%v [%v]',
          args=[LocalAddr, LocalPort, RemoteAddr, RemotePort, Status]),
       Username=NULL, CreateTime=NULL
FROM net_hunt

#!/bin/bash
# dcm4chee-arc-light exposure check and interim hardening (run on the archive host)
# Reference: CISA ICSMA-26-288-02

echo "=== 1. Identify running dcm4chee version ==="
# Check the deployment directory / WildFly deployments for the archive version
find / -name "dcm4chee-arc-*.war" -o -name "dcm4chee-arc-light*" 2>/dev/null | head -20
# If deployed in Docker:
docker ps --format '{{.Names}} {{.Image}}' 2>/dev/null | grep -i dcm4chee

echo "=== 2. Verify listener exposure ==="
# DICOM 11112, HTTP 8080, HTTPS 8443, WildFly mgmt 9990 — mgmt must never be broadly reachable
ss -tlnp | grep -E ':(11112|2762|8080|8443|9990)\b'

echo "=== 3. Confirm management interface is loopback-only ==="
# 9990 bound to 0.0.0.0 = immediate finding. Restrict in standalone.xml:
#   <inet-address value="${jboss.bind.address.management:127.0.0.1}"/>

echo "=== 4. Emergency containment: restrict DICOM/web ports to clinical subnets ==="
# Adjust subnets to your modality/RIS networks — EXAMPLE ONLY, validate before applying
# firewall-cmd --permanent --new-zone=pacs
# firewall-cmd --permanent --zone=pacs --add-source=10.20.0.0/16   # clinical VLAN
# firewall-cmd --permanent --zone=pacs --add-port=11112/tcp
# firewall-cmd --permanent --zone=pacs --add-port=8443/tcp
# firewall-cmd --reload

echo "=== 5. Capture forensic evidence of prior unauthenticated access BEFORE patching ==="
# WildFly access/audit logs and DICOM association logs
tar czf /tmp/dcm4chee-logs-$(date +%F).tgz \
  /opt/wildfly/standalone/log/ 2>/dev/null
find / -path '*/dcm4chee*' -name '*.log' -mtime -30 2>/dev/null | head -50

echo "=== 6. Check for unexpected studies/patient-record churn in the archive DB ==="
# Review archive audit logs for DELETE/MOVE/merge patient operations you cannot attribute
# to scheduled reconciliation workflows before assuming the archive is clean.