Description
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| J4Care | dcm4chee-arc-light | 5.35.1 | 5.35.2 |
Advisories 1
- ICSMA-26-288-02 J4Care dcm4che CISA ICS & IT advisories · Oct 15, 2026