Loading story…
The U.S. Food and Drug Administration issued a Class 2 recall for certain GE HealthCare Centricity Universal Viewer medical imaging products after identifying a cybersecurity vulnerability that could expose user login credentials on a local client workstation. The flaw could allow an unauthorized person to manipulate data or affect system availability, although GE said exploitation requires direct physical access to the affected workstation and that no unauthorized access to patient data has been reported.
GE HealthCare said the issue was discovered during routine testing and that customers were notified through an urgent medical device correction letter. While the company prepares a permanent fix, it has advised healthcare organizations to maintain appropriate workstation security controls and use Active Directory-based network account authentication. GE said it will remediate all affected products at no cost.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
On March 19, 2026, the U.S. Food and Drug Administration posted a Class 2 recall notice for certain GE HealthCare Centricity Universal Viewer products due to the cybersecurity vulnerability. GE said no unauthorized access to patient data had been reported.
On Jan. 30, GE HealthCare sent customers an urgent medical device correction letter about the affected products. The company advised customers to maintain workstation security controls and use Active Directory-based network account authentication while it prepares a permanent fix at no cost.
GE HealthCare said it discovered a cybersecurity vulnerability in certain Centricity Universal Viewer medical imaging products during routine testing. The flaw could expose user login credentials on a local client workstation and could allow unauthorized data manipulation or affect system availability if someone had direct physical access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
3 references tracked. Mallory keeps watching after this page renders.
hipaajournal.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Internet-facing medical-imaging deployments running **Orthanc PACS** administrative consoles and **OHIF** web viewers were found exposed through HTTP/S interfaces, creating potential access to sensitive imaging records. Passive scanning identified 414 reachable Orthanc consoles and 700 OHIF viewers; in the United States, 36 of 91 identified Orthanc consoles—about 40%—accepted access without an authentication challenge, while 43 were protected and 12 could not be conclusively classified. The exposure is linked to insecure deployment defaults, including reuse of a canonical OHIF-Orthanc Docker configuration. **CVE-2025-0896** documents that Orthanc does not enable authentication by default when remote access is enabled. The exposed systems appear more likely to belong to smaller self-hosted radiology and pathology practices than enterprise hospital environments, underscoring the need to restrict public access, require authentication, and review internet-exposed DICOM and imaging-management services.
Sep 23, 2026
CISA issued an advisory for **CVE-2026-3650**, a high-severity denial-of-service vulnerability in **Grassroots DICOM (GDCM) 3.2.2)**, a C++ library used to process DICOM medical images in healthcare environments. The flaw is a **memory leak** (`CWE-401`) triggered when the library parses malformed DICOM files containing non-standard VR types in file meta information, leading to excessive memory allocation, heap exhaustion, and potential service disruption from a single read operation. The issue carries a **CVSS v3.1 score of 7.5** with the vector `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`. Researchers **Volodymyr Bihunenko, Mykyta Mudryi, and Markiian Chaklosh of ARIMLABS** reported the vulnerability to CISA. The agency said the bug could be exploited remotely by sending a specially crafted file and warned that affected organizations in the **healthcare and public health sector worldwide** may be exposed if they rely on the library. CISA reported no known public exploitation at publication time, but said **no patch is currently available** and that the maintainer did not respond to mitigation requests; in the meantime, it recommended reducing exposure by keeping affected systems off the public internet, segmenting networks behind firewalls, and securing remote access with up-to-date VPNs.
Jun 29, 2026
A high-severity server-side request forgery flaw in **OHIF DICOM Web Viewer Framework** tracked as `CVE-2026-12473` could let attackers steal authenticated clinicians’ OIDC bearer tokens by luring them to open a crafted link. The issue affects versions prior to **3.12.0** and stems from the default **DICOMWebProxy** and **DICOMJSON** data sources accepting arbitrary URL parameters without validation, while OHIF’s global authentication service may automatically attach the user’s bearer token to outbound requests sent to attacker-controlled infrastructure. The flaw does **not** affect DICOMweb data sources. The vulnerability carries high-severity ratings of **CVSS 4.0 8.3** and **CVSS 3.1 8.2**, and remediation guidance urges organizations to upgrade to the fixed release **3.12.2**, disable unnecessary DICOMWebProxy and DICOMJSON data sources, validate all URL parameters, block arbitrary URL fetching, and restrict OIDC token injection to trusted hosts. Public reporting and advisory material indicate the bug is remotely exploitable and particularly relevant to authenticated healthcare imaging deployments where token exposure could enable unauthorized access.
Jun 29, 2026