noindex and left out of the sitemap until more data is confirmed.CVE-2026-111594 is a cleartext-transmission weakness in InterSystems IRIS for Health: the superserver's TLS/SSL encryption is off by default, so network traffic between clients and the server — including credentials and patient data — can be read by anyone able to observe it; NVD has not yet completed its own CVSS scoring, so this page stays noindex until that analysis is published.
Vulnerability summary
N/A
Not yet scored
0.2%
EPSS score (FIRST)
No
CISA KEV catalog
2026-10-22
Published
Vulnerability ID: CVE-2026-111594 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| InterSystems IRIS for Health | — | 2026.2.0.221, 2026.1.0.235, 2025.3.0.226 (per CISA Advisory ICSMA-26-295-01); not yet a published NVD CPE applicability statement |
What this means
CVE-2026-111594 is a cleartext transmission of sensitive information weakness (CWE-319) in InterSystems IRIS for Health. CISA's medical-device advisory states the product "has TLS/SSL encryption turned off by default," which "may enable an attacker to view transmitted data and use that data to log into the device" (CISA Advisory ICSMA-26-295-01).
NVD tracks CVE-2026-111594 with status "Awaiting Analysis" as of 2026-10-23: it has recorded a CVSS v3.1 score of 8.1 (high, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and a CVSS v4.0 score of 9.2 (critical), both submitted by CISA's ICS-CERT as secondary scores — not NVD's own independently-published analysis — so this page leaves cvss_score unset rather than presenting the ICS-CERT figure as NVD-confirmed (NVD).
The same CISA advisory is the primary technical source here because the CVE's assigner is CISA's ICS-CERT program and no separate InterSystems-hosted public advisory page for this CVE was found; it reports affected versions 2026.2.0.221, 2026.1.0.235 and 2025.3.0.226, states no patched version is currently available, and recommends setting the superserver's SSL/TLS configuration to "Required" — noting that the "Enabled" setting still permits unencrypted connections — plus restricting network access until a fix ships (CISA Advisory ICSMA-26-295-01).
CISA's advisory states no known public exploitation of this CVE has been reported, and it is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-27. FIRST scores the probability of exploitation at 0.0019 (8.5th percentile) — very low, consistent with a configuration weakness that requires network-position access rather than a remotely triggerable code flaw (CISA KEV, FIRST EPSS).
Because this is a healthcare system that can carry patient records and diagnostic data, operators should set the superserver TLS/SSL requirement to "Required" and restrict network access to trusted segments now, rather than waiting for NVD's independent severity analysis or a vendor patch.
Evidence
- InterSystems IRIS for Health has TLS/SSL off by default on its superserver, allowing an attacker who can observe traffic to read and reuse credentials and clinical data (CWE-319). — CISA Advisory ICSMA-26-295-01
- NVD status is "Awaiting Analysis" with ICS-CERT-submitted CVSS v3.1 8.1 and CVSS v4.0 9.2 (both secondary scores, not NVD's own); no NVD-published score as of 2026-10-23. — NVD
- Affects IRIS for Health 2026.2.0.221, 2026.1.0.235, 2025.3.0.226; no patched version available; recommended mitigation is setting TLS/SSL to "Required" and restricting network access. — CISA Advisory ICSMA-26-295-01
- Not present in the CISA KEV catalog as of 2026-10-27; no known public exploitation reported to CISA. — CISA KEV
- EPSS score is 0.0019 (8.5th percentile) as of 2026-10-26. — FIRST EPSS
