# InterSystems IRIS for Health TLS Disabled by Default

Published: 2026-10-22 · Severity: routine · Sectors: Healthcare
Canonical: https://vorant.io/reports/dd98976f-5194-5674-b464-8a3424106353/intersystems-iris-for-health-tls-disabled-by-default

> InterSystems IRIS for Health ships with TLS/SSL disabled by default, allowing attackers to intercept credentials and sensitive health data in transit.

CISA published an ICS medical advisory for InterSystems IRIS for Health, a healthcare data platform deployed worldwide. The vulnerability, tracked as CVE-2026-111594 (CVSS v3 8.1), stems from the product's default configuration leaving TLS/SSL encryption disabled on the IRIS superserver. This allows an attacker with network access to view transmitted data in cleartext (CWE-319) and potentially use captured credentials to log into the device.

Affected versions include InterSystems IRIS for Health 2026.2.0.221, 2026.1.0.235, and 2025.3.0.226. There is no known public exploitation of this vulnerability at this time; it was responsibly reported to CISA and InterSystems by researcher Abhinav Agarwal.

InterSystems recommends administrators explicitly configure the IRIS superserver to require TLS rather than relying on defaults, which only 'enable' (optional) rather than 'require' TLS. CISA further advises standard ICS network hardening: minimizing internet exposure, isolating control system networks behind firewalls, and using secure remote access methods such as VPNs where needed.

## Mentioned in this report

- Vulnerabilities: CVE-2026-111594

Source reporting: https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/dd98976f-5194-5674-b464-8a3424106353/intersystems-iris-for-health-tls-disabled-by-default.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup