CVE-2026-111594
CVE-2026-111594 · InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information
This page contains facts from public vulnerability sources. Check the original advisory before updating.
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
CVSS 9.2 · Critical · EPSS 0.2%
- Published
- Updated
Affected products and versions
iris for health
- Versions
- 2026.2.0.221: Affected
- 2026.1.0.235: Affected
- 2025.3.0.226: Affected
No fix published
Original sources
- https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist
- https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver
- https://wrc.intersystems.com
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-295-01.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-111594