CVE-2026-111594: CWE-319 in InterSystems IRIS for Health

CVE-2026-111594 describes a vulnerability in InterSystems IRIS for Health where TLS/SSL encryption is turned off by default. This lack of encryption can enable an attacker with network access to capture sensitive data transmitted in cleartext. The attacker may leverage this intercepted data to authenticate and gain unauthorized access to the device. The vulnerability is categorized under CWE-319, indicating exposure of sensitive information during transmission. The affected versions explicitly include 2025.3.0.226, 2026.1.0.235, and 2026.2.0.221. No patch or vendor advisory information is provided regarding remediation.

The vulnerability allows an attacker to view sensitive data transmitted over the network due to disabled TLS/SSL encryption by default. This exposure can lead to unauthorized login to the device, compromising confidentiality, integrity, and availability of the system. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability with network attack vector and no privileges or user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to manually enable TLS/SSL encryption in InterSystems IRIS for Health configurations to protect transmitted data. Network-level protections such as VPNs or encrypted tunnels may also reduce exposure.