Skip to content
NewA calmer, faster ZeroHour
Vulnerabilityhigh

InterSystems IRIS for Health cleartext transmission vulnerability

Original title: InterSystems Corporation InterSystems IRIS for Health

CISA Advisoriesby CISA ()3 min read1
Read at cisa.gov
AI summary · x-ai/grok-4.7Summaries by Vani AI

InterSystems IRIS for Health versions 2026.2.0.221, 2026.1.0.235 and 2025.3.0.226 allow default TLS/SSL disablement; configure superserver to require TLS.

InterSystems Corporation InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device. CISA issued an advisory for the healthcare critical infrastructure sector. Affected versions include 2026.2.0.221, 2026.1.0.235 and 2025.3.0.226. Mitigation is to configure the IRIS superserver to require SSL/TLS. CVSS 8.1.

Unconfirmed: CVE-2026-111594 listed three times with same description

Key facts
  • Configure IRIS superserver to require TLS per InterSystems documentation
  • Contact InterSystems WRC for system-specific mitigation
  • Reported by Abhinav Agarwal to CISA and InterSystems
Security assessment · AI, from the article

Impact: view transmitted data and use that data to log into the device

ProductAffected
InterSystems Corporation InterSystems IRIS for Health2026.2.0.221, 2026.1.0.235, 2025.3.0.226
What to do
  1. 1.Configure IRIS superserver to require SSL/TLS
Analyze CVE-2026-111594 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-111594
Tags
intersystemsirishealthcisaics
Vendors
InterSystems Corporation
Products
InterSystems IRIS for Health
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111594
Cleartext by default in InterSystems IRIS for Health
9.2—

From the original article

3 min read at cisa.gov

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device. The following versions of InterSystems Corporation InterSystems IRIS for Health are affected: InterSystems IRIS for Health 2026. 2.

CISA Advisories

By CISA · cisa.gov

Read the full article at CISA Advisories

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.