Loading story…
Internet-facing medical-imaging deployments running Orthanc PACS administrative consoles and OHIF web viewers were found exposed through HTTP/S interfaces, creating potential access to sensitive imaging records. Passive scanning identified 414 reachable Orthanc consoles and 700 OHIF viewers; in the United States, 36 of 91 identified Orthanc consoles—about 40%—accepted access without an authentication challenge, while 43 were protected and 12 could not be conclusively classified.
The exposure is linked to insecure deployment defaults, including reuse of a canonical OHIF-Orthanc Docker configuration. CVE-2025-0896 documents that Orthanc does not enable authentication by default when remote access is enabled. The exposed systems appear more likely to belong to smaller self-hosted radiology and pathology practices than enterprise hospital environments, underscoring the need to restrict public access, require authentication, and review internet-exposed DICOM and imaging-management services.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Using passive data collected on June 29, 2026, researchers identified 414 internet-reachable Orthanc administrative consoles and 700 OHIF medical-image viewers on HTTP/S web ports. In the United States, 36 of 91 observed Orthanc consoles were confirmed accessible without an authentication challenge.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Industrial and building-automation environments continue to expose **operational technology (OT)** services directly to the public internet, increasing the likelihood of unauthorized access and disruption. An *Intelligence-Driven Active Defense Report 2026* cited by Palo Alto Networks/Siemens/Idaho National Laboratory data indicates internet exposure is growing sharply, with *Cortex Xpanse* reporting **110M+ observations** of exposed OT devices in 2024 and fingerprinting **19.6M unique OT devices/services** across **1.77M IPv4 addresses**; the highest concentrations were observed in the **US, China, and Germany**. Frequently observed exposed products included **Tridium Niagara**, **Linear eMerge**, and **Saia PCD Web Server**, and common exposure points included standard web ports `TCP/443` and `TCP/80` alongside OT/building-automation-associated ports such as `TCP/502`, `UDP/47808`, and Niagara-related ports like `TCP/4911` and `TCP/5011`. Similar internet-exposure risk was observed in healthcare, where Rapid7 Labs reported **30+ UK-based systems** responding to **DICOM** requests over `TCP/104` (the default medical imaging port) from the public internet. Rapid7 stated it used *Project Sonar* to validate service responsiveness only and did not attempt to access records, but warned that externally reachable DICOM services—especially without VPN restriction or encryption—are readily discoverable via routine scanning and were not designed for hostile networks. Prior research cited in the report indicates misconfigured or poorly controlled **PACS/DICOM** deployments can leak sensitive metadata (including patient identifiers) and may be susceptible to data reconstruction or modification, creating both **cybersecurity** and **patient safety** risk.
Jun 29, 2026
A high-severity server-side request forgery flaw in **OHIF DICOM Web Viewer Framework** tracked as `CVE-2026-12473` could let attackers steal authenticated clinicians’ OIDC bearer tokens by luring them to open a crafted link. The issue affects versions prior to **3.12.0** and stems from the default **DICOMWebProxy** and **DICOMJSON** data sources accepting arbitrary URL parameters without validation, while OHIF’s global authentication service may automatically attach the user’s bearer token to outbound requests sent to attacker-controlled infrastructure. The flaw does **not** affect DICOMweb data sources. The vulnerability carries high-severity ratings of **CVSS 4.0 8.3** and **CVSS 3.1 8.2**, and remediation guidance urges organizations to upgrade to the fixed release **3.12.2**, disable unnecessary DICOMWebProxy and DICOMJSON data sources, validate all URL parameters, block arbitrary URL fetching, and restrict OIDC token injection to trusted hosts. Public reporting and advisory material indicate the bug is remotely exploitable and particularly relevant to authenticated healthcare imaging deployments where token exposure could enable unauthorized access.
Jun 29, 2026
CISA issued an advisory for **CVE-2026-3650**, a high-severity denial-of-service vulnerability in **Grassroots DICOM (GDCM) 3.2.2)**, a C++ library used to process DICOM medical images in healthcare environments. The flaw is a **memory leak** (`CWE-401`) triggered when the library parses malformed DICOM files containing non-standard VR types in file meta information, leading to excessive memory allocation, heap exhaustion, and potential service disruption from a single read operation. The issue carries a **CVSS v3.1 score of 7.5** with the vector `AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`. Researchers **Volodymyr Bihunenko, Mykyta Mudryi, and Markiian Chaklosh of ARIMLABS** reported the vulnerability to CISA. The agency said the bug could be exploited remotely by sending a specially crafted file and warned that affected organizations in the **healthcare and public health sector worldwide** may be exposed if they rely on the library. CISA reported no known public exploitation at publication time, but said **no patch is currently available** and that the maintainer did not respond to mitigation requests; in the meantime, it recommended reducing exposure by keeping affected systems off the public internet, segmenting networks behind firewalls, and securing remote access with up-to-date VPNs.
Jun 29, 2026