A Hidden Vulnerability in Healthcare: Exposed DICOM Servers and the Risk to Patient Data

TrendAI™ analysis found 3,627 DICOM imaging servers exposed to the internet across 100+ countries with near-absent TLS (0.14%), widespread use of default AE Titles, and concentrated, unpatched software stacks (DCMTK, OsiriX, Orthanc). The report details critical CVEs (CVSS 7.5–9.8), examples of public exploit code, attack paths using DICOM commands (C-FIND/C-GET/C-MOVE/C-STORE), and the resulting risk of PHI theft, image manipulation, ransomware, and lateral movement — recommending network isolation, TLS/AE validation, patching, and detection/prevention controls mapped to TrendAI products.