CISA published two advisories on October 15 covering nine vulnerabilities, six in the J4Care dcm4chee-arc-light medical image archive and three in EseeCloud IP cameras. The dcm4chee flaws have a fix in version 5.35.2 or later, but the camera maker has not issued one. CISA reports no known public exploitation and no confirmed proof-of-concept for either set.
ICSMA-26-288-02: Six dcm4chee-arc-light Flaws Put Medical Images at Risk
The first advisory, ICSMA-26-288-02, covers the dcm4chee-arc-light DICOM archive from J4Care. Exploitation could let an attacker delete stored medical images, disclose patient information, inject forged studies, reassign patient records, overwrite files and cause denial of service.
Three of the six flaws are denial-of-service bugs rated 7.5 each: CVE-2026-107621, CVE-2026-105273 and CVE-2026-101021. They use crafted JPEG, MP4 or multipart input to trap the parser in a loop or burn CPU.
Updating to 5.35.2 and Restricting DICOM and HL7 Access
J4Care customers should update to dcm4chee-arc-light 5.35.2 or later. CISA also advises restricting DICOM and HL7 access to trusted systems. The ability to inject forged studies or reassign patient records is the most clinically significant of the listed impacts, because altered imaging data could mislead the clinicians who rely on it.
ICSA-26-288-02: EseeCloud Cameras Carry a Hard-Coded Credential and No Fix
The second advisory, ICSA-26-288-02, covers IP cameras from Guangzhou Juan IoT Technology marketed under the EseeCloud name. It lists three flaws. CVE-2026-107617, rated 9.8, is a hard-coded credential that allows login. CVE-2026-97858 and CVE-2026-105664, both medium severity, let attackers rebind devices to their own accounts and discover registered devices at scale.
The cameras serve the energy, communications, transportation, finance and government sectors. Researchers Abhinav Agarwal and Donghyeon Lee reported the flaws.
Vendor Silence Leaves EseeCloud Owners Without a Patch
Guangzhou Juan IoT Technology did not respond to CISA’s coordination attempts, and no fix exists. CISA’s guidance is to keep the cameras off the internet and place them behind firewalls. Where that is not enough, the practical option is replacement.
The combination of a hard-coded credential and device rebinding is a poor fit for sensitive environments. A hard-coded credential means every unit shares the same weakness, and the discovery flaw lets an attacker locate registered devices at scale rather than hunting them one at a time. Organizations in the sectors named above should inventory their cameras to determine whether any are EseeCloud units.
What the Two Advisories Mean for Healthcare and Critical Infrastructure Operators
The two advisories differ in remediation but share a theme: devices that handle sensitive data or monitor physical sites can be exposed through weaknesses in parsing, authentication and device management. The dcm4chee advisory gives operators a clear path through an update and access restriction. The EseeCloud advisory offers only compensating controls because the vendor has not responded.
Network Restriction as the Common Control
Network restriction is the one control that appears in both sets of guidance. For dcm4chee, that means limiting DICOM and HL7 access to trusted systems. For EseeCloud, it means keeping cameras off the internet and behind firewalls. Neither control fixes the underlying flaw, but both reduce who can reach it.
CISA reports no known public exploitation of either set, which gives defenders time to act. Healthcare operators running dcm4chee should prioritize the update, while any organization with EseeCloud cameras in energy, transportation or government facilities should treat replacement as the long-term answer, since a fix from the vendor appears unlikely.
Neither advisory reports confirmed exploit code. CISA’s note that no public proof-of-concept exists covers both the dcm4chee and EseeCloud sets, though a hard-coded credential like CVE-2026-107617 is the kind of weakness that does not require a sophisticated exploit once the credential is known. Operators of the affected products should confirm their versions and exposure now instead of waiting for evidence of attacks.
