# CVE-2026-111594: InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information

Status: published. Published: 2026-10-22. Updated: 2026-11-02.

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

## Remediation

- workaround: InterSystems recommends users configure IRIS superserver to require SSL/TLS:  https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist  Note that there are three settings: "Disabled", which means that client communications do not use TLS. "Enabled", which means that client communications may use TLS (but they also may not) and "Required", which forces all client communications to use TLS.



InterSystems documentation explains how to configure the server to require TLS:  https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver 



For more information about how to configure a system to mitigate this vulnerability, contact InterSystems at their world wide response center:  https://wrc.intersystems.com  (login required) (source: CNA: icscert)

## Affected products and versions

- InterSystems / IRIS for Health: 2026.2.0.221 (affected); 2026.1.0.235 (affected); 2025.3.0.226 (affected). Source: CNA: icscert

## Severity and prioritization

- CVSS 3.1: 8.1 (high); CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H; source: CNA: icscert

- CVSS 4.0: 9.2 (critical); CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N; source: CNA: icscert

- CISA KEV: No listing in collected sources

- EPSS: 0.19% as of 2026-11-01; percentile 8.64%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-319

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist (CNA: icscert)

- https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver (CNA: icscert)

- https://wrc.intersystems.com/ (CNA: icscert)

- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01 (CNA: icscert)

- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-295-01.json (CNA: icscert)

## Provenance

- CNA: icscert: https://www.cve.org/CVERecord?id=CVE-2026-111594; retrieved 2026-11-02; source updated 2026-11-02

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-111594; retrieved 2026-11-02; source updated Not reported

Revision: 1100a9fb4f651dc9aaf0475913f10b6ac61d2cc8ea75c09dc6d4ee878becc250

Canonical: https://y2.dev/cve/CVE-2026-111594