Paper/Archive/CVE-2026-111594

CVE-2026-111594

InterSystems IRIS for Health — InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information

EPSS 0.2%CVSS 9.2

critical.is priorityof 100

CVSS 9.2 (CNA)9.2 / 10 × 3027.6 Not in CISA KEV+300.0 EPSS percentile 8.6.086 × 201.7 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

Affected

ProductAffectedFixed inSource

IRIS for Health2026.2.0.221–CNA

IRIS for Health2026.1.0.235–CNA

IRIS for Health2025.3.0.226–CNA

Scores by source

icscert (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

icscert (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refdocs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist refdocs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver refwrc.intersystems.com refcisa.gov/news-events/ics-medical-advisories/icsma-26-295-01 refgithub.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-295-01.json