InterSystems IRIS for Health Cleartext Transmission of Sensitive Information

InterSystems IRIS for Health

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

Do this now

Enable TLS on InterSystems IRIS for Health and restrict network access until a vendor fix is available.

Still cooking for IRIS for Health.

First seen: 22 Oct 2026
Last update: 22 Oct 2026, 12:00 UTC
Identifiers: CVE-2026-111594
CVSS: 8.1
Source: news
On the menu as: Healthcare IT

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## InterSystems IRIS for Health Cleartext Transmission of Sensitive Information
Severity: high. Patch status: no fix yet.
Affected: InterSystems IRIS for Health
Ids: CVE-2026-111594

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

## Steps
1. Search the repo, its CI and infra config for InterSystems IRIS for Health. If present, report the version in use and whether it's affected.
2. There is no fix yet. Until one ships: InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-111594") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
https://pwned.coffee/i/intersystems-iris-for-health-cleartext-transmission-of-s-cve-2026-111594

Receipt

Exploitation: No known exploitation
CISA “No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.” source
Fix by release line: Product Affected Fixed in Source
IRIS for Health = 2026.2.0.221 no fix on 2026.2.x yet CVE record (CNA)
IRIS for Health = 2026.1.0.235 no fix on 2026.1.x yet CVE record (CNA)
IRIS for Health = 2025.3.0.226 no fix on 2025.3.x yet CVE record (CNA)
Score: CVSS 8.1 (high). CVSS 3.1 8.1 (CNA icscert) for CVE-2026-111594
Last checked: 24 Oct 2026, 18:17 UTC

Product	Affected	Fixed in	Source
IRIS for Health	= 2026.2.0.221	no fix on 2026.2.x yet	CVE record (CNA)
IRIS for Health	= 2026.1.0.235	no fix on 2026.1.x yet	CVE record (CNA)
IRIS for Health	= 2025.3.0.226	no fix on 2025.3.x yet	CVE record (CNA)

Sources: KEV – CVE record ✓ Vendor ✓

Sources

cisa.gov: InterSystems Corporation InterSystems IRIS for Health

Totalone hot coffee