CISA has issued two advisories detailing nine vulnerabilities in the dcm4chee-arc-light medical archive and in Guangzhou Juan IoT Technology’s EseeCloud IP cameras, with three critical flaws in EseeCloud and six in the dcm4chee archive.
For dcm4chee-arc-light, CVSS 9.1 concerns include missing authentication for critical functions (CVE-2026-105279) and missing authorization (CVE-2026-97851), plus additional high/medium risks such as authentication/authorisation gaps (CVE-2026-105667) and denial-of-service–type issues arising from crafted inputs (CVE-2026-107621, CVE-2026-105273, CVE-2026-101021).
CISA warns that exploitation could enable deletion or manipulation of stored medical images, disclosure of patient information, forged studies, reassignment of records, file overwrites, or denial of service. The advisory notes that these flaws affect J4Care dcm4chee-arc-light version 5.35.1, with fixes available in 5.35.2 or later, and recommends restricting DICOM and HL7 access to trusted systems. Evidence for exploitation is currently unconfirmed; no public exploitation or PoCs have been reported.
In EseeCloud, CVSS 9.8 highlights include hard-coded credentials enabling login to EseeCloud devices (CVE-2026-107617), alongside two medium flaws (CVE-2026-97858 and CVE-2026-105664) that allow re-binding devices to attacker accounts or bulk device discovery. According to CISA, there is no patch available yet; Guangzhou Juan IoT Technology did not respond to coordination attempts. The article advises keeping EseeCloud cameras off the internet and behind firewalls, or replacing them where feasible.
Affected EseeCloud versions include the app up to 4.9.6 and firmware up to 4.9.86[.]0. Researchers Abhinav Agarwal and Donghyeon Lee reported the flaws to CISA. While the highest-risk dcm4chee issues are deemed urgent, the EseeCloud flaws remain unpatched and require practical mitigations.