InterSystems recommends configuring the IRIS superserver to require SSL/TLS by setting the encryption mode to "Required". This forces all client communications to use TLS, mitigating the risk of cleartext data transmission. Refer to InterSystems documentation for configuration guidance. Contact the InterSystems Worldwide Response Center for additional support (login required).
Quick answers
What is CVE-2026-111594?
InterSystems recommends configuring the IRIS superserver to require SSL/TLS by setting the encryption mode to "Required". This forces all client communications to use TLS, mitigating the risk of cleartext data transmission. Refer to InterSystems documentation for configuration guidance. Contact the InterSystems Worldwide Response Center for additional support (login required).
How severe is CVE-2026-111594?
critical, CVSS 9.2
Is CVE-2026-111594 known to be exploited?
It is not marked known-exploited in this record.
How should CVE-2026-111594 be mitigated?
InterSystems recommends configuring the IRIS superserver to require SSL/TLS by setting the encryption mode to "Required". This forces all client communications to use TLS, mitigating the risk of cleartext data transmission. Refer to InterSystems documentation for configuration guidance. Contact the InterSystems Worldwide Response Center for additional support (login required).
CVSS
9.2
Vendor
InterSystems Corporation
Published
Oct 24, 2026 · 05:35
Patch
Unknown / not confirmed
Affected products
InterSystems IRIS for Health 2026.2.0.221, InterSystems IRIS for Health 2026.1.0.235, InterSystems IRIS for Health 2025.3.0.226
Mitigation
InterSystems recommends configuring the IRIS superserver to require SSL/TLS by setting the encryption mode to "Required". This forces all client communications to use TLS, mitigating the risk of cleartext data transmission. Refer to InterSystems documentation for configuration guidance. Contact the InterSystems Worldwide Response Center for additional support (login required).
InterSystems Corporation InterSystems IRIS for Health versions 2026.2.0.221, 2026.1.0.235, and 2025.3.0.226 are affected by CVE-2026-111594, a vulnerability where TLS/SSL encryption is turned off by default. Successful exploitation could allow attackers to view transmitted data and use it to log into the device. The issue carries a CVSS v4 base score of 9.2 (CRITICAL) and is classified under CWE-319. No confirmed active exploitation has been reported, but the default configuration poses significant risk to healthcare and public health sector critical infrastructure worldwide.