Public vulnerability disclosure

CVE-2026-111594

InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information

publishedCWE-319

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

Investigate in Cyber JSON Markdown

Technical severity8.1 highCVSS 3.1 · CNA: icscert

Published2026-10-22Source updated 2026-11-02

Collected2026-11-022 attributed sources

Fixes and workarounds

Workaround

InterSystems recommends users configure IRIS superserver to require SSL/TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist Note that there are three settings: "Disabled", which means that client communications do not use TLS. "Enabled", which means that client communications may use TLS (but they also may not) and "Required", which forces all client communications to use TLS. InterSystems documentation explains how to configure the server to require TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver For more information about how to configure a system to mitigate this vulnerability, contact InterSystems at their world wide response center: https://wrc.intersystems.com (login required)

Source: CNA: icscert

Affected products and versions

Affected products, source version ranges and reporting authorities
Product	Versions	Authority
IRIS for Health InterSystems	2026.2.0.221 (affected) 2026.1.0.235 (affected) 2025.3.0.226 (affected) Other versions: unaffected	CNA: icscert

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

CVSS scores, vectors and reporting authorities
Version / score	Vector	Authority
3.1 / 8.1 high	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`	CNA: icscert
4.0 / 9.2 critical	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`	CNA: icscert

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.