InterSystems IRIS for Health: Cleartext transmission of sensitive information
Summary
TLS encryption for the IRIS for Health superserver is disabled by default. An attacker with a network position between a client and the server can observe traffic, which may include credentials, and reuse them to log in to the system. No login is needed for the interception itself.
Affected
- InterSystems IRIS for Health 2026.2.0.221
- InterSystems IRIS for Health 2026.1.0.235
- InterSystems IRIS for Health 2025.3.0.226
- Default configuration (TLS disabled on the superserver)
Fixed in
Unknown. No fixed release has been identified; the vendor states that no product change is currently planned.
Workaround
- Set the superserver SSL/TLS support level to "Required" (not "Enabled", which permits unencrypted connections).
- Ensure clients verify the server certificate chain and identity.
- Do not expose the superserver directly to untrusted networks, including the internet; use firewalls and network segmentation.
- Audit all IRIS instances, including default superservers on new installations.
Exploitation
- No known public exploitation has been reported to CISA at this time.
- No public proof of concept identified (Exploit-DB: none).
- A KEV listing conflict was found in one bulletin; the KEV catalog should be checked directly.
Our recommendation
- Inventory all IRIS for Health instances in the environment; if none exist, no action is needed.
- Enforce TLS "Required" on all superservers and verify client certificate validation.
- Restrict superserver access to trusted networks and check whether any instance is reachable from outside.
- Monitor the InterSystems WRC and CISA advisory ICSMA-26-295-01 for a vendor fix.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CISA ICSMA-26-295-01 www.cisa.gov
- CISA ICSMA-26-295-01 CSAF file github.com
- InterSystems community post on CVE-2026-111594 community.intersystems.com
- InterSystems: Managing Superservers docs.intersystems.com
- InterSystems: Security Checklist docs.intersystems.com
- InterSystems WRC wrc.intersystems.com
- VulDB CVE-2026-111594 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 04:04.
Original description (NVD)
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
NVD references (5)
- https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver
- https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-295-01.json
- https://wrc.intersystems.com
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.