Skip to content
NewA calmer, faster ZeroHour
Vulnerability

CVE-2026-111594

Cleartext by default in InterSystems IRIS for Health

CVSS 4.0
9.2 critical
EPSS
—
Published
·
Modified
Analyze CVE-2026-111594 with Vani AIImpact, affected versions, exploitation status, mitigations and detection
AI analysisSummaries by Vani AI

InterSystems IRIS for Health ships with TLS/SSL encryption off by default (CWE-319). A remote attacker who can observe network traffic may read transmitted data and reuse it to log into the device, without prior authentication or user interaction. Deployments that leave the default encryption setting unchanged are affected. No affected or fixed versions are stated.

What to do: Turn on TLS/SSL for InterSystems IRIS for Health. No fixed version is stated.

ProductAffected
InterSystems Corporation InterSystems IRIS for Health—
Estimated exposure
No basis for an estimate.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description · NVD

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

Weakness
CWE-319
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD CVE.org GitHub PoCs EPSS (—)

In the news

1 story