CVE-2026-56445Disclosure

LOWCVSS 8.8 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Prioritize remediation for affected systems immediately
Assume compromise if assets are exposed
Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowing file writes to arbitrary paths.

Back to dashboard

3.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
4 mentions across 3 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Technical details provided in 4 signals
Disclosure: 3 classified signals
Peaked 2d ago at 2 mentions (2026-06-25); latest day: 1
4 total mentions across 3 days

Deep dive

Activity timeline4 mentions / 3d

Signal classification2 categories

Disclosure

375.0%

Active Exploitation

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-25	2	Disclosure2
2026-06-26	1	Disclosure1
2026-06-27	1	Active Exploitation1

Full discourse4 posts

ADK Cyber@ADKCyber90d
Disclosure
CVE-2026-56445 (CVSS 9.1) allows arbitrary file writes in qrscp DICOM C-STORE handler. Healthcare organizations using DICOM should review affected systems. https://nvd.nist.gov/vuln/detail/CVE… via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/DiP4O75dkl
Post summary
The tweet announces CVE-2026-56445, a high‑CVSS0.9.1 vulnerability that allows arbitrary file writes in qrscp DICOM C‑STORE handler, urging healthcare organizations to review affected systems.
0001047
92 followersView on X
Infoflowcloud@infoflowcloud91d
Disclosure
🚨*CVE* CVE-2026-56445 The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowing file … https://www.cve.org/CVERecord?id=CVE-2026-56445 ----- Traducción: CVE-2026-56445 El … http://infoflow.cloud`
Post summary
The text announces CVE-2026-56445, describing an unsanitized os.path.join() usage in qrscp's C-STORE handler that could allow attackers to manipulate file paths via DICOM data; no PoC, exploitation, patch, or mitigation is referenced.
0001038
89 followersView on X
Aviatrix Threat Research Center@aviatrixtrc90d
Active Exploitation
Attackers exploited CVE-2026-56445 to achieve unauthenticated file writes in healthcare systems, then escalated privileges and moved laterally across networks. Runtime segmentation could have limited the blast radius of this multi-stage attack chain. #Healthcare #ZeroTrust :link: Full breakdown: https://aviatrix.ai/threat-research-center/pydicom-pynetdicom-library-cve-2026-56445
Post summary
Attackers used CVE-2026-56445 to write files without authentication, escalating privileges and moving laterally across healthcare networks, demonstrating active exploitation of the flaw.
0000054
1.9K followersView on X
CVE@CVEnew91d
Disclosure
CVE-2026-56445 The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datasets directly in os.path.join() without sanitization, allowing file … https://www.cve.org/CVERecord?id=CVE-2026-56445
Post summary
A vulnerability (CVE‑2026‑56445) was disclosed in the qrscp C‑STORE handler where unsanitized attacker‑supplied DICOM data is used in os.path.join(), potentially enabling path manipulation; no PoC, exploit, active exploitation or patch was mentioned.
00000638
57.7K followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-56445

ADK Cyber[verified]@ADKCyberDisclosure

The tweet announces CVE-2026-56445, a high‑CVSS0.9.1 vulnerability that allows arbitrary file writes in qrscp DICOM C‑STORE handler, urging healthcare organizations to review affected systems.

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

Attackers used CVE-2026-56445 to write files without authentication, escalating privileges and moving laterally across healthcare networks, demonstrating active exploitation of the flaw.

Infoflowcloud@infoflowcloudDisclosure

The text announces CVE-2026-56445, describing an unsanitized os.path.join() usage in qrscp's C-STORE handler that could allow attackers to manipulate file paths via DICOM data; no PoC, exploitation, patch, or mitigation is referenced.

CVE@CVEnewDisclosure

A vulnerability (CVE‑2026‑56445) was disclosed in the qrscp C‑STORE handler where unsanitized attacker‑supplied DICOM data is used in os.path.join(), potentially enabling path manipulation; no PoC, exploit, active exploitation or patch was mentioned.