CVE-2026-97851

Summary

The flaw allows attackers to bypass deletion controls for DICOM storage locations, enabling unauthorized deletion of stored medical images while leaving database records intact. This creates a data integrity issue where files disappear but system records still show them as present.

Exploitability

Exploitation is straightforward requiring only network access to the storage status-change REST service with no authentication required, allowing immediate deletion of DICOM instances from storage.

Blast radius

The impact could be severe in healthcare environments where medical imaging data integrity is critical, potentially leading to loss of patient records and false system states where deleted images appear to still exist.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the affected REST service endpoint until a patch is available, or restrict access to it via network segmentation and authentication controls.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.