InterSystems IRIS for Health TLS Disabled by Default
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
InterSystems IRIS for Health ships with TLS/SSL disabled by default, allowing attackers to intercept credentials and sensitive health data in transit.
CISA published an ICS medical advisory for InterSystems IRIS for Health, a healthcare data platform deployed worldwide. The vulnerability, tracked as CVE-2026-111594 (CVSS v3 8.1), stems from the product's default configuration leaving TLS/SSL encryption disabled on the IRIS superserver. This allows an attacker with network access to view transmitted data in cleartext (CWE-319) and potentially use captured credentials to log into the device.
Affected versions include InterSystems IRIS for Health 2026.2.0.221, 2026.1.0.235, and 2025.3.0.226. There is no known public exploitation of this vulnerability at this time; it was responsibly reported to CISA and InterSystems by researcher Abhinav Agarwal.
InterSystems recommends administrators explicitly configure the IRIS superserver to require TLS rather than relying on defaults, which only 'enable' (optional) rather than 'require' TLS. CISA further advises standard ICS network hardening: minimizing internet exposure, isolating control system networks behind firewalls, and using secure remote access methods such as VPNs where needed.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 13,989 reports from 143 sources, 543 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs