CVE-2026-111594
InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information
CVSS Score
8.1
EPSS Score
0.0%
EPSS Percentile
0th
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
| CWE | CWE-319 |
| Vendor | intersystems |
| Product | iris for health |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for intersystems iris for health
Be the first to know when new high vulnerabilities affecting intersystems iris for health are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
InterSystems / IRIS for Health
2026.2.0.221 2026.1.0.235 2025.3.0.226
References
docs.intersystems.com: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist docs.intersystems.com: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver wrc.intersystems.com: https://wrc.intersystems.com cisa.gov: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01 github.com: https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-295-01.json
Credits
Abhinav Agarwal reported this vulnerability to CISA and InterSystems Corporation.