---
id: "CVE-2026-111594"
kind: "vulnerability"
aliases: ["CVE-2026-111594"]
title: "InterSystems IRIS for Health: TLS off by default exposes traffic and logins"
severity: "critical"
cvss: 9.2
epss: 0.00183
exploited: false
status: "open"
category: "runtime"
products: [{"name": "InterSystems IRIS for Health", "fixed": [], "affected": "2026.2.0.221, 2026.1.0.235, 2025.3.0.226 (listed builds; others not stated)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cleartext", "healthcare", "intersystems", "iris-for-health", "runtime", "self-hosted", "tls"]
not_affected_if: ["superserver-not-network-reachable", "tls-enabled-in-config", "tls-required-on-superserver"]
published_at: "2026-10-22T22:18:01+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111594", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:44:16+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111594", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# InterSystems IRIS for Health: TLS off by default exposes traffic and logins

IRIS for Health's superserver (default port 1972, serves JDBC/ODBC/native, Web Gateway, ECP, mirroring) accepts unencrypted client connections by default. An attacker who can capture traffic on the network path can read authentication traffic and replay it to the superserver to get the captured account's privileges. InterSystems calls this a configuration issue: no fixed release exists and no product change is planned.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:InterSystems IRIS for Health affected 2026.2.0.221, 2026.1.0.235, 2025.3.0.226 (listed builds; others not stated) fixed ?

## How to check

In the Management Portal go to System Administration > Security > Superservers (or Configuration > Superservers) and open each superserver, including the default one on port 1972. If 'SSL/TLS support level' is Disabled or Enabled, you are exposed, because Enabled still allows plaintext. Only Required is safe. Also check that clients verify the server certificate. Check which hosts can reach the superserver port.

## Fix

No patched version. Set each superserver's SSL/TLS support level to Required with a valid SSL/TLS server configuration, and configure clients to verify the certificate chain and server identity. Also: set 'Allowed Incoming Connections' on superserver-dependent services (%Service_Bindings, DataCheck, ECP, Monitor, Sharding, WebGateway), disable unused services, use firewall and segmentation rules, never expose the superserver to the internet, and use the mirror-specific TLS setup for mirroring.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111594
- 2026-10-23T22:44:16+00:00 analyst — CISA ICSMA-26-295-01 and InterSystems community post read. No patch: vendor says config-only fix, no product change planned. Affected builds 2026.2.0.221, 2026.1.0.235, 2025.3.0.226 (other builds not stated). No exploitation reported, no PoC, no X chatter. CVSS v3.1 is 8.1 and v4.0 is 9.2; severity left unchanged.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111594

## Documents

- [advisory] CISA ICSMA-26-295-01 InterSystems IRIS for Health https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
- [mitigation] InterSystems: Securing IRIS Superserver Connections (CVE-2026-111594) https://community.intersystems.com/post/securing-intersystems-iris-superserver-connections-cve-2026-111594
- [mitigation] Managing Superservers (InterSystems docs) https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver

## From the sources

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_