Critical Cleartext Transmission Vulnerability (CVE‑2026‑111594) in InterSystems IRIS for Health
What It Is — InterSystems IRIS for Health ships with TLS/SSL encryption disabled by default, exposing client‑server traffic to eavesdropping. The flaw (CVE‑2026‑111594) carries a CVSS v3.1 base score of 8.1, classifying it as a high‑severity issue.
Exploitability — No public exploit code is required; any adversary who can observe network traffic can capture clear‑text credentials and patient data. The vulnerability is listed in CISA’s Industrial Control Systems Medical Advisory, indicating active awareness by U.S. authorities.
Affected Products — InterSystems IRIS for Health versions:
- 2025.3.0.226
- 2026.1.0.235
- 2026.2.0.221
Why It Matters for Trust & Control Assurance
- Shows the necessity of continuous verification that encryption controls are enforced across all health‑IT deployments.
- Provides audit‑ready evidence that a “protect data in transit” control is operating—a prerequisite for many regulatory frameworks.
- Highlights the value of automated configuration monitoring to surface mis‑configurations before they become exploitable.
Recommended Actions
- Enable TLS/SSL on the IRIS superserver immediately, following InterSystems’ hardening checklist.
- Run a configuration scan of every IRIS for Health instance to confirm encryption is active.
- Integrate the encryption setting into your continuous control‑monitoring program and retain evidence for audit purposes.
Source: CISA Advisory – ICSMA‑26‑295‑01