Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.2
CVE-2026-111594: InterSystems IRIS for Health sends data without encryption
CVE-2026-111594 · published 16 days ago
Summary
The InterSystems IRIS for Health product does not enable TLS/SSL encryption by default, so information sent over the network is in clear text. This allows anyone who can intercept the traffic to read the data and potentially use it to access the system. Enable TLS/SSL encryption in the configuration as soon as possible to protect the data in transit.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| intersystems | iris for health | 2026.2.0.221 |
Original advisory text
InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
References
- https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROA...
- https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA...
- https://wrc.intersystems.com
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
- https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-2...
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-319Cleartext Transmission of Sensitive Information
Timeline
Published22 Oct 2026
Updated2 Nov 2026
First seen22 Oct 2026
Track software like this
Free during beta