CVE-2026-111594: InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed?
Deployments using InterSystems IRIS for Health with the default TLS/SSL settings are exposed because encryption is turned off by default. Network-accessible traffic is the relevant exposure point.
What does an attacker need to exploit this issue?
An attacker needs the ability to observe transmitted traffic. The disclosed impact is that they may view sensitive data and use captured data to log into the device.
What should be done if the deployment is using default settings?
Enable TLS/SSL encryption for the affected communications rather than leaving the default unencrypted configuration in place. The provided documentation includes security-checklist and SuperServer management references.