TLS/SSL Configuration Weakness in InterSystems Product
CVE-2026-111594

9.2CRITICAL

Key Information:

Vendor

Intersystems

Status
Iris For Health
Vendor
CVE Published:
22 October 2026

What is CVE-2026-111594?

InterSystems IRIS for Health ships with TLS/SSL encryption disabled by default, which can leave sensitive transmitted data exposed to unauthorized access. Attackers could potentially intercept data transfers over the network, risking the security and confidentiality of information. Organizations utilizing IRIS for Health should prioritize enabling robust encryption measures to mitigate these risks and ensure secure data handling.

Affected Version(s)

IRIS for Health 2026.2.0.221

IRIS for Health 2026.1.0.235

IRIS for Health 2025.3.0.226

References

https://docs.intersystems.com/irislatest/csp/docbook/DocB...
https://docs.intersystems.com/irislatest/csp/docbook/DocB...
https://wrc.intersystems.com

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhinav Agarwal reported this vulnerability to CISA and InterSystems Corporation.
.