{"id":"CVE-2026-111594","kind":"vulnerability","aliases":["CVE-2026-111594"],"related":[],"title":"InterSystems IRIS for Health: TLS off by default exposes traffic and logins","description":"InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.","summary":"IRIS for Health's superserver (default port 1972, serves JDBC/ODBC/native, Web Gateway, ECP, mirroring) accepts unencrypted client connections by default. An attacker who can capture traffic on the network path can read authentication traffic and replay it to the superserver to get the captured account's privileges. InterSystems calls this a configuration issue: no fixed release exists and no product change is planned.","severity":"critical","cvss":9.2,"epss":0.00183,"exploited":false,"exploited_at":null,"products":[{"name":"InterSystems IRIS for Health","fixed":[],"affected":"2026.2.0.221, 2026.1.0.235, 2025.3.0.226 (listed builds; others not stated)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cleartext","healthcare","intersystems","iris-for-health","runtime","self-hosted","tls"],"not_affected_if":["superserver-not-network-reachable","tls-enabled-in-config","tls-required-on-superserver"],"how_to_check":"In the Management Portal go to System Administration > Security > Superservers (or Configuration > Superservers) and open each superserver, including the default one on port 1972. If 'SSL/TLS support level' is Disabled or Enabled, you are exposed, because Enabled still allows plaintext. Only Required is safe. Also check that clients verify the server certificate. Check which hosts can reach the superserver port.","fix":"No patched version. Set each superserver's SSL/TLS support level to Required with a valid SSL/TLS server configuration, and configure clients to verify the certificate chain and server identity. Also: set 'Allowed Incoming Connections' on superserver-dependent services (%Service_Bindings, DataCheck, ECP, Monitor, Sharding, WebGateway), disable unused services, use firewall and segmentation rules, never expose the superserver to the internet, and use the mirror-specific TLS setup for mirroring.","status":"open","published_at":"2026-10-22T22:18:01+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-23T22:31:40+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-23T22:31:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"InterSystems IRIS for Health: TLS off by default exposes traffic and logins","impact":"high","summary":"InterSystems IRIS for Health ships with TLS/SSL encryption disabled by default. An attacker on the network path can read transmitted data and reuse it to log into the device.","category":"runtime","who_cares":["intersystems","iris-for-health","healthcare","self-hosted"],"confidence":0.6,"needs_auth":"no","worst_case":"attacker reads traffic and logs in to the device","analyst_note":"Find the InterSystems advisory and the affected IRIS for Health versions and the setting that enables TLS; the NVD entry alone does not give them.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["tls-enabled-in-config"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000452,"input_tokens":2887,"output_tokens":327,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the InterSystems advisory and the affected IRIS for Health versions and the setting that enables TLS; the NVD entry alone does not give them.","search":"'-111594':15A,18A '-2026':14A,17A '1972':42B 'accept':49B 'account':79B 'attack':56B,113C 'authent':67B 'call':83B 'captur':59B,78B 'chang':95B 'cleartext':23B 'client':51B 'configur':86B 'connect':52B 'cve':13A,16A 'data':117C,121C 'default':8A,40B,54B,108C 'devic':126C 'ecp':47B 'enabl':111C 'encrypt':104C 'exist':91B 'expos':9A 'fix':89B 'for':21A 'gateway':46B 'get':76B 'health':4A,22A,29B,37B,101C 'healthcar':24B 'host':33B 'intersystem':1A,25B,82B,98C 'intersystems':19A 'iri':2A,27B,35B,99C 'iris':20A 'iris-for-health':26B 'issu':87B 'jdbc/odbc/native':44B 'log':123C 'login':12A 'may':110C 'mirror':48B 'network':63B 'path':64B 'plan':97B 'port':41B 'privileg':81B 'product':94B 'read':66B 'releas':90B 'replay':70B 'runtim':30B 'self':32B 'self-host':31B 'serv':43B 'superserv':39B,74B 'tls':5A,34B 'tls/ssl':103C 'traffic':10A,60B,68B 'transmit':116C 'turn':105C 'unencrypt':50B 'use':119C 'view':115C 'web':45B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T22:18:01+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ics-cert@hq.dhs.gov","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111594","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111594","severity":null,"published_at":"2026-10-22T22:18:01+00:00","modified_at":"2026-10-23T19:43:46+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111594:285","url":null,"severity":null,"published_at":"2026-10-23T22:44:16+00:00","modified_at":"2026-10-23T22:44:16+00:00","first_seen_at":"2026-10-23T22:44:16+00:00","fetched_at":"2026-10-23T22:44:16+00:00","note":"CISA ICSMA-26-295-01 and InterSystems community post read. No patch: vendor says config-only fix, no product change planned. Affected builds 2026.2.0.221, 2026.1.0.235, 2025.3.0.226 (other builds not stated). No exploitation reported, no PoC, no X chatter. CVSS v3.1 is 8.1 and v4.0 is 9.2; severity left unchanged."},{"source":"epss","external_id":"CVE-2026-111594","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111594","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1587,"url":"https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01","title":"CISA ICSMA-26-295-01 InterSystems IRIS for Health","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1588,"url":"https://community.intersystems.com/post/securing-intersystems-iris-superserver-connections-cve-2026-111594","title":"InterSystems: Securing IRIS Superserver Connections (CVE-2026-111594)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null},{"id":1589,"url":"https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver","title":"Managing Superservers (InterSystems docs)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"mitigation","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}