---
id: CVE-2026-111594
title: >-
  InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission
  of Sensitive Information
summary: >-
  InterSystems IRIS for Health has TLS/SSL encryption turned off by default,
  which may enable an attacker to view transmitted data and use that data to log
  into the device.
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-319
vendor: InterSystems
product: IRIS for Health
affected:
  - iris_for_health 2026.2.0.221
  - iris_for_health 2026.1.0.235
  - iris_for_health 2025.3.0.226
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T21:39:47.105Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111594'
references:
  - url: >-
      https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist
  - url: >-
      https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver
  - url: 'https://wrc.intersystems.com'
  - url: 'https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01'
  - url: >-
      https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-295-01.json
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.449Z'
---

## Overview

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

## Affected

- `iris_for_health 2026.2.0.221`
- `iris_for_health 2026.1.0.235`
- `iris_for_health 2025.3.0.226`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

InterSystems recommends users configure IRIS superserver to require SSL/TLS:  https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist  Note that there are three settings: "Disabled", which means that client communications do not use TLS. "Enabled", which means that client communications may use TLS (but they also may not) and "Required", which forces all client communications to use TLS.



InterSystems documentation explains how to configure the server to require TLS:  https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver 



For more information about how to configure a system to mitigate this vulnerability, contact InterSystems at their world wide response center:  https://wrc.intersystems.com  (login required)