How do I check whether I am affected by CVE-2026-111594?

In the Management Portal go to System Administration > Security > Superservers (or Configuration > Superservers) and open each superserver, including the default one on port 1972. If 'SSL/TLS support level' is Disabled or Enabled, you are exposed, because Enabled still allows plaintext. Only Required is safe. Also check that clients verify the server certificate. Check which hosts can reach the superserver port.

What is the fix for CVE-2026-111594?

No patched version. Set each superserver's SSL/TLS support level to Required with a valid SSL/TLS server configuration, and configure clients to verify the certificate chain and server identity. Also: set 'Allowed Incoming Connections' on superserver-dependent services (%Service_Bindings, DataCheck, ECP, Monitor, Sharding, WebGateway), disable unused services, use firewall and segmentation rules, never expose the superserver to the internet, and use the mirror-specific TLS setup for mirroring.

Who is not affected by CVE-2026-111594?

Not affected if: superserver-not-network-reachable, tls-enabled-in-config, tls-required-on-superserver.

Live › vulnerability › CVE-2026-111594

Go to dashboard

critical9.2Runtime

InterSystems IRIS for Health: TLS off by default exposes traffic and logins

IRIS for Health's superserver (default port 1972, serves JDBC/ODBC/native, Web Gateway, ECP, mirroring) accepts unencrypted client connections by default. An attacker who can capture traffic on the network path can read authentication traffic and replay it to the superserver to get the captured account's privileges. InterSystems calls this a configuration issue: no fixed release exists and no product change is planned.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.2

critical

scored by [email protected]

known so far6 of 6

First public: Oct 22, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.2% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: No.
Reachable from: network.
Worst case: Attacker reads traffic and logs in to the device.
CVSS said: 9.2. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-111594

Go to dashboard

critical9.2Runtime

InterSystems IRIS for Health: TLS off by default exposes traffic and logins

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.2

critical

scored by [email protected]

known so far6 of 6

First public: Oct 22, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: 0.2% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: No.
Needs a special setup: No.
Reachable from: network.
Worst case: Attacker reads traffic and logs in to the device.
CVSS said: 9.2. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

InterSystems IRIS for Health: TLS off by default exposes traffic and logins

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

InterSystems IRIS for Health: TLS off by default exposes traffic and logins

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources