CVE-2026-44628: Worklist Server Denial of Service (CVSS 7.5)

Technical summary

This vulnerability stems from improper type handling in worklist server query processing, classified under CWE-843 (Access of Resource Using Incompatible Type). An attacker can supply a malformed query that causes the server to mishandle data types during processing, leading to an unhandled exception or memory violation that crashes the process. The vulnerability requires network access but no authentication, making it remotely exploitable by any actor with network visibility to the worklist port. The crash is reliable and reproducible when the prerequisite server conditions are present.

Business impact

Worklist servers are critical infrastructure in healthcare environments, coordinating diagnostic procedures and patient workflows. A denial-of-service attack disrupts scheduling, delays patient care, and forces operational teams into reactive recovery mode. In high-volume imaging centers, even brief outages can cascade into extended delays. Organizations cannot rely on automatic recovery; manual intervention is required to restart the service. The lack of authentication requirements means the attack surface includes any network path to the worklist service, whether internal or—in misconfigured deployments—external.

Affected systems

No specific vendor or product information is available in the current advisory. Organizations operating DICOM-compliant worklist servers should assume potential exposure and verify compatibility with their specific implementations. Worklist servers are commonly deployed in radiology information systems (RIS), enterprise imaging platforms, and healthcare IT networks. The vulnerability's reliance on specific server conditions (valid AE Title, storage directory, lockfile, and existing records) means not all instances may be exploitable, but this should not be assumed without testing.

Exploitability

Exploitation is straightforward and requires only network access to the worklist service port and knowledge of a valid Called AE Title—information often discoverable through network scanning or reconnaissance. No authentication, no complex setup, and no user interaction is needed. The attacker need only craft and send a single malformed query. Reliable reproduction depends on the target server state; however, most production worklist servers maintain the required conditions (valid AE Title, storage directory, lockfile, and records) as part of normal operation. This is a low-complexity, high-impact attack vector.

Remediation

Apply vendor patches as soon as they become available. Until patching is complete, implement network-level access controls to restrict worklist service ports to authorized imaging and scheduling systems only. Isolate worklist servers on segmented networks, require VPN or firewall rules for access, and monitor for unusual query patterns. Implement service restart automation and alerting to minimize downtime if exploitation occurs. Verify patching against vendor advisories and security bulletins, as no specific patch versions are currently identified in public guidance.

Patch guidance

Contact your worklist server vendor for security updates addressing CVE-2026-44628. Patches may be released as hotfixes, minor version updates, or service packs depending on vendor release cycles. Establish a test environment matching your production configuration, validate patches against the vulnerability conditions (AE Title, storage directory, lockfile, and worklist records), and schedule deployment during low-demand periods to minimize impact on clinical workflows. Verify patch application by confirming version updates and re-testing with known attack queries in a controlled lab setting.

Detection guidance

Monitor worklist server logs for unexpected crashes, restarts, or error messages related to query processing failures. Implement network-based detection for malformed DICOM queries or unusual query patterns directed at worklist ports. Alert on repeated failed queries from the same source, which may indicate reconnaissance or attack attempts. Baseline normal worklist traffic (query frequency, size, syntax patterns) and flag significant deviations. Log and review any service restarts initiated outside of scheduled maintenance windows. DICOM protocol analyzers or packet capture tools can help identify suspicious query structures.

Why prioritize this

A CVSS score of 7.5 (HIGH severity) reflects the vulnerability's network accessibility, lack of authentication requirements, and direct impact on service availability. While confidentiality and integrity are not compromised, the denial-of-service impact on critical healthcare infrastructure justifies urgent attention. The simplicity of exploitation and the reliability of the attack in production environments elevate practical risk beyond the base score. Healthcare organizations should prioritize patching ahead of less critical systems.

Risk score, explained

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects: Network-based attack vector with no privilege requirements and low attack complexity; no impact on confidentiality or integrity; but high impact on availability. The score of 7.5 appropriately captures a serious but contained threat—not the highest severity, but sufficient to warrant rapid remediation. Organizations should weight business criticality and network exposure when translating this score into internal risk ratings; a worklist server serving a large clinical network may warrant treat-as-critical prioritization despite the base HIGH rating.

Frequently asked questions