Cisagov Csaf: Eight Vulnerabilities Disclosed Together, Two Critical
Key findings • Eight vulnerabilities in Cisagov Csaf disclosed together on October 16, 2026, with two rated critical. • Flaws include unauthorized data access, deletion of medical images, and…
Key findings
- Eight vulnerabilities in Cisagov Csaf disclosed together on October 16, 2026, with two rated critical.
- Flaws include unauthorized data access, deletion of medical images, and denial-of-service conditions.
- Vulnerabilities stem from inadequate authentication and authorization in default configurations.
- Exploitation could allow attackers to control IP cameras and access sensitive patient information.
- Affected products include J4Care dcm4che and Guangzhou Juan IoT Technology EseeCloud.
On October 16, 2026, CISA released advisories detailing eight vulnerabilities affecting Cisagov's Csaf product, with a critical severity cluster and a tight disclosure window of just one hour. These vulnerabilities, impacting various components of the Csaf system, could allow attackers to gain control over affected devices, delete stored medical images, disclose patient information, and cause denial-of-service conditions.
Several vulnerabilities stem from inadequate authentication and authorization checks in default configurations. CVE-2026-105279, a critical flaw with a CVSSv3 score of 9.1, allows remote peers to enumerate and retrieve patient information and medical images by establishing DICOM associations from unregistered calling AE. Similarly, CVE-2026-105667, a high-severity vulnerability, permits remote senders to reassign studies and workflow records without authentication due to the HL7 listener accepting unauthenticated patient-merge messages. Another critical vulnerability, CVE-2026-97851 (CVSSv3 9.1), allows the storage status-change REST service to change location records to deletion-related states, leading to the deletion of referenced objects from storage even when the instance record remains in the database.
Other vulnerabilities include denial-of-service and information disclosure risks. CVE-2026-107621 and CVE-2026-105273, both rated high severity, involve infinite loops in JPEGParser and MP4Parser respectively, triggered by specially crafted or truncated streams and malformed box sizes, respectively. CVE-2026-101021, also high severity, is due to inefficient boundary matching and buffer copying in MultipartInputStream, which can be exploited by crafted multipart input. CVE-2026-97858 and CVE-2026-105664, both medium severity, allow attackers to rebind devices to their accounts and exploit observable response discrepancies for information disclosure, respectively. These vulnerabilities were disclosed in conjunction with advisories for Guangzhou Juan IoT Technology EseeCloud and J4Care dcm4che.
The affected versions for J4Care dcm4che are dcm4chee-arc-light 5.35.1, and for Guangzhou Juan IoT Technology EseeCloud, affected versions include EseeCloud App <=4.9.6 and EseeCloud Firmware <=4.9.86.0. The advisories indicate that successful exploitation could lead to a range of impacts, from gaining control over IP cameras to deleting medical images and disclosing sensitive patient data. Users are advised to consult the specific advisories from CISA for detailed mitigation steps and recommended actions.
This batch of vulnerabilities underscores the importance of secure configurations and timely patching for systems handling sensitive medical and operational data. The coordinated disclosure by CISA highlights the interconnectedness of security in the IoT and healthcare technology sectors. Users of Cisagov Csaf and related products should prioritize reviewing and applying any available updates to mitigate these risks.