November 10, 2026 The FDA Just Recalled a PACS Over a Hijackable Admin Session: What It Means for Your Dental Imaging Software
Most dental practices think of their imaging software the way they think of the lights: it either works or it does not. The X-rays appear, the CBCT loads, the intraoral shots file themselves away. What rarely gets asked is a harder question — who, besides your team, could reach inside that archive, and what could they do once they were in?
A fresh regulatory action makes that question urgent. The U.S. Food and Drug Administration has issued a Class 2 recall for IntelePACS, a picture archiving and communication system (PACS) from Intelerad Medical Systems used by imaging facilities around the world. The reason is not a hardware fault. It is a software vulnerability that lets an attacker hijack an administrator session — and from there, modify or delete study data and lock legitimate clinicians out of their own system.
What was actually recalled — and why “recall” is the right word
A PACS is the software and storage that receives images from your capture devices, keeps them, and serves them back when a clinician needs to review a case. IntelePACS is a large, hospital-scale example of exactly that category. The FDA’s Class 2 recall — the agency’s designation for a problem that can cause temporary or medically reversible harm — was triggered by a flaw that allows an attacker to take over an administrator session on the system.
That matters because regulators are increasingly treating a software defect with the same seriousness as a physical device defect. A vulnerability in code that holds diagnostic images is now “recall-worthy,” the same as a faulty sensor would be. Intelerad is instructing affected facilities to enforce strict access controls while patches are developed — a telling sign that the immediate mitigation is operational discipline, not a button to press.
Why this is worse than a data breach
When most practices imagine an imaging-system compromise, they picture copied files — a privacy incident. This flaw is more dangerous than that. Because it hands over administrative control, an attacker can alter or delete studies and shut legitimate users out entirely.
Sit with what altered imaging means in a clinical setting. A radiograph is not a document; it is the evidence a diagnosis rests on. If study data can be changed or quietly removed, the integrity of the record itself is in question — which decayed tooth, which bone-loss measurement, which pre-operative scan can you still trust? For a dental practice, that is not only a patient-safety problem, it is a medico-legal one. A stolen image is a privacy breach you disclose and remediate. A tampered image can mislead care long after the attacker has gone.
“But we’re a dental office, not a hospital”
It is fair to point out that IntelePACS is an enterprise hospital platform and most dental practices do not run it. But that misses the lesson. The moment your practice stores digital radiographs, panoramic images, CBCT volumes, or intraoral photos in software that archives and serves them, you are running a PACS-class system — whether it is badged as imaging software, a practice-management module, or a bundled sensor application. The same two weaknesses at the heart of this recall apply directly to you:
- Administrative sessions are a crown jewel. If one admin login to your imaging software can be hijacked, everything downstream — every study, every patient’s history — is reachable.
- Imaging platforms often lag on modern security. Many are built for clinical workflow first and hardened security second, which is precisely why they struggle to fit a zero-trust model where no session is automatically trusted.
This is the same structural risk we flagged when a state began auditing the cybersecurity of imaging hardware in the supply chain: the devices and software that create your clinical images are now an attack surface, not just a tool.
How to tell whether your imaging software is exposed
You do not need to read the CVE to ask the right questions. Put these to whoever supports your imaging system:
- How many administrator accounts exist on our imaging/PACS software, and who holds them? Most practices discover they have more than they need, often shared.
- Is the imaging system reachable from the internet in any way — remote viewing, a vendor support tunnel, a cloud portal? Anything exposed externally is where a session-hijack flaw gets exploited.
- Are we on a supported version, and how do security patches reach us? If updates arrive only when a technician visits, you are perpetually behind.
- Could we detect a study being altered or deleted? If the answer is no, you have an integrity blind spot.
What to do now
The mitigation Intelerad is urging — strict access controls while a patch is built — is exactly the right template for any practice, recall or not:
- Audit administrator access first. Reduce admin accounts on the imaging system to the minimum, give each person their own named login, and remove any shared or dormant admin credentials. Fewer privileged sessions means fewer sessions to hijack.
- Segment the imaging system off the general network. Your radiography and CBCT archive should not sit on the same flat network as the front-desk PC and the staff Wi-Fi. Isolation limits how far an intruder can move.
- Close external exposure. Remote access to imaging software belongs behind a VPN and multi-factor authentication — never open to the public internet. This is the same baseline raised by the HIPAA Security Rule overhaul’s push toward mandatory MFA and encryption.
- Protect image integrity with real backups. Keep a recent, offline or immutable copy of your imaging archive so that altered or deleted studies can be restored to a known-good state. As the recent attacks hunting practice backup appliances showed, a backup an attacker can also reach is not really a backup.
- Patch on a schedule you can prove. Confirm your imaging vendor’s security update path and apply fixes promptly — and keep a record that you did.
The bottom line
The IntelePACS recall is a signal, not an isolated event. Regulators now treat a hijackable imaging session as a defect serious enough to recall, and the underlying weakness — over-privileged admin access to software that holds clinical images — lives in dental practices every bit as much as in hospitals. You may never run IntelePACS, but you almost certainly run something that archives your patients’ images, and the questions it raises about who controls that archive are yours to answer.
If you are not certain how many administrator accounts can reach your imaging system, whether it is exposed to the internet, or whether a deleted study could be restored, that uncertainty is the exposure. Contact Compudent Systems for an imaging-system and access-control security review, and we will help confirm that the archive your diagnoses depend on is under your control alone.
Sources & further reading:
- Cybersecurity vulnerability prompts recall of popular PACS software (Radiology Business)
- FDA Recalls IntelePACS Software Over Cyber Risk (Yesil Science)
- NIST SP 1800-24: Securing Picture Archiving and Communication System (PACS)
Related Reading
- From Roentgen’s Lab to Your Practice Server: How Dental X-ray Imaging Became an IT Discipline
- A Poisoned Image Can Crash Your Imaging Server: The Orthanc DICOM Flaw (CVE-2026-87020) and Why Your PACS Shouldn’t Face the Internet
- The ADA Now Says Scan Less — So Your Records Have to Say Why: What the 2026 Imaging Guidelines Mean for Your Practice Software