{"generated_at":"2026-10-25T09:52:24.570Z","count":1,"incidents":[{"id":"intersystems-iris-for-health-cleartext-transmission-of-s-cve-2026-111594","url":"https://pwned.coffee/i/intersystems-iris-for-health-cleartext-transmission-of-s-cve-2026-111594","title":"InterSystems IRIS for Health Cleartext Transmission of Sensitive Information","summary":"InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.","severity":"high","brew":{"name":"Americano","temp":"183°C"},"patch_status":"unpatched","bucket":"nofix","kitchen":{"name":"86'd","plain":"No fix yet"},"order_reason":"the rest, by urgency","status":"live","exploited":false,"exploitation":"none_known","exploitation_label":"No known exploitation","public_poc":false,"receipt":[{"kind":"no_known","quote":"No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.","url":"https://www.cisa.gov/news-events/ics-advisories/icsma-26-295-01"},{"kind":"score","quote":"CVSS 3.1 8.1 (CNA icscert) for CVE-2026-111594","url":"https://www.cve.org/CVERecord?id=CVE-2026-111594"}],"kev_due":null,"do":"Enable TLS on InterSystems IRIS for Health and restrict network access until a vendor fix is available.","affected":"InterSystems IRIS for Health","fixed_versions":[],"fix_lines":[{"product":"IRIS for Health","from":"2026.2.0.221","range":"= 2026.2.0.221","note":"fix not named in the CVE record: see vendor advisory","state":"unknown","unknown_reason":"cna_affected_only","source":"cna","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111594","verified_at":"2026-10-25T06:20:21.708Z","quote":"IRIS for Health 2026.2.0.221 affected"},{"product":"IRIS for Health","from":"2026.1.0.235","range":"= 2026.1.0.235","note":"fix not named in the CVE record: see vendor advisory","state":"unknown","unknown_reason":"cna_affected_only","source":"cna","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111594","verified_at":"2026-10-25T06:20:21.708Z","quote":"IRIS for Health 2026.1.0.235 affected"},{"product":"IRIS for Health","from":"2025.3.0.226","range":"= 2025.3.0.226","note":"fix not named in the CVE record: see vendor advisory","state":"unknown","unknown_reason":"cna_affected_only","source":"cna","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-111594","verified_at":"2026-10-25T06:20:21.708Z","quote":"IRIS for Health 2025.3.0.226 affected"}],"downstream":[],"fix_note":"InterSystems recommends users configure IRIS superserver to require SSL/TLS Note that there are three settings: \"Disabled\", which means that client communications do not use TLS.","not_affected_products":[],"vendor_notes":[],"related":[],"cvss":8.1,"severity_source":{"label":"CVSS 3.1 8.1 (CNA icscert) for CVE-2026-111594","url":"https://www.cve.org/CVERecord?id=CVE-2026-111594"},"spreading_until":null,"still_cooking":[],"published":"2026-10-22T21:39:47.105Z","checked_at":"2026-10-25T09:17:18.607Z","unverified_ids":[],"ids":["CVE-2026-111594"],"aliases":[],"stack":["health-it"],"first_seen":"2026-10-22T12:00:00.000Z","updated_at":"2026-10-22T12:00:00.000Z"}]}