{"id":"CVE-2026-97851","published":"2026-10-16T15:17:38.490","lastModified":"2026-10-16T20:04:29.760","description":"The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes PurgeStorageScheduler to delete the referenced object from storage even though the corresponding instance record remains in the database.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cwes":["CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json","tags":[]},{"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-02","tags":[]}],"exploitRefs":[{"url":"https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-288-02.json","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows attackers to bypass deletion controls for DICOM storage locations, enabling unauthorized deletion of stored medical images while leaving database records intact. This creates a data integrity issue where files disappear but system records still show them as present.","exploitability":"Exploitation is straightforward requiring only network access to the storage status-change REST service with no authentication required, allowing immediate deletion of DICOM instances from storage.","blast_radius":"The impact could be severe in healthcare environments where medical imaging data integrity is critical, potentially leading to loss of patient records and false system states where deleted images appear to still exist.","remediation":"Disable the affected REST service endpoint until a patch is available, or restrict access to it via network segmentation and authentication controls.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["storage","dicom","data-loss"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:49:05.622Z"}}