Critical TLS/SSL Vulnerability Affects InterSystems IRIS for Health

InterSystems Corporation has issued a security advisory regarding a vulnerability in InterSystems IRIS for Health, identified as CVE-2026-111594. The flaw stems from TLS/SSL encryption being disabled by default in affected versions, including 2026.2.0.221, 2026.1.0.235, and 2025.3.0.226. According to the advisory, successful exploitation could allow an attacker to view transmitted data and leverage that information to gain unauthorized access to the device.

The vulnerability impacts Critical Infrastructure Sectors, specifically Healthcare and Public Health, with deployments worldwide. The CVSS v3 base score is 8.1 (HIGH) with a vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, while the CVSS v4 base score is 9.2 (CRITICAL) with a vector of CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. The issue has been mapped to CWE-319 (Cleartext Transmission of Sensitive Information).

The vulnerability was reported to CISA and InterSystems Corporation by Abhinav Agarwal. CISA has published advisory ICSMA-26-295-01 and recommends that users minimize network exposure for control system devices, ensure they are not internet-accessible, locate control system networks behind firewalls, and isolate them from business networks. When remote access is required, the use of Virtual Private Networks (VPNs) is advised, though VPNs may have their own vulnerabilities.

InterSystems recommends mitigating the issue by configuring the IRIS superserver to require SSL/TLS. Specifically, users should set the encryption mode to "Required" to force all client communications to use TLS. Documentation is available through InterSystems' online resources, and further assistance can be obtained via the InterSystems Worldwide Response Center (login required). As of the advisory publication, no specific patched firmware versions have been listed, but the configuration change is intended to remediate the risk.