CISA Warns of Cleartext Transmission Vulnerability in InterSystems IRIS for Health
CISA has issued an advisory regarding a critical vulnerability in InterSystems IRIS for Health that could allow attackers to intercept sensitive data and gain unauthorized access.
CISA has alerted organizations to a significant security flaw affecting InterSystems IRIS for Health software, specifically identified as CVE-2026-111594. This vulnerability stems from the default configuration where TLS/SSL encryption is disabled, leaving data transmitted over the network exposed.
Successful exploitation of this vulnerability could enable an attacker to intercept sensitive information exchanged between the system and its clients. This intercepted data could then be used to authenticate and log into the affected devices, posing a severe risk to data confidentiality and system integrity. The vulnerability has been assigned a CVSS v3.1 base score of 8.1 (HIGH) and a CVSS v4.0 score of 9.2 (CRITICAL), underscoring its severity.
The affected versions of InterSystems IRIS for Health include 2026.2.0.221, 2026.1.0.235, and 2025.3.0.226. These versions are deployed globally within the Healthcare and Public Health critical infrastructure sectors, highlighting the widespread potential impact.
InterSystems has provided mitigation guidance, strongly recommending that users configure their IRIS superserver to require SSL/TLS. The company outlines three distinct settings for client communications: "Disabled," where TLS is not used; "Enabled," where TLS may be used but is not enforced; and "Required," which mandates TLS for all client communications. The "Required" setting is crucial for addressing this vulnerability.
Detailed instructions on how to configure the server to enforce TLS can be found in the InterSystems documentation. For further assistance or more in-depth information on mitigating this vulnerability, users are advised to contact InterSystems' worldwide response center, though login may be required.
CISA emphasizes that this vulnerability falls under the CWE-319 category, "Cleartext Transmission of Sensitive Information." This classification points to the core issue: the lack of encryption allowing sensitive data to be transmitted in plain text.
In addition to vendor-specific mitigations, CISA reiterates its general best practices for securing control systems. These include minimizing network exposure, isolating control system networks behind firewalls, and using secure remote access methods like VPNs, ensuring that all components, including VPNs, are kept up-to-date.
Organizations experiencing suspected malicious activity related to this vulnerability are encouraged to follow their internal procedures and report findings to CISA for correlation with other ongoing incidents. Proactive defense strategies and thorough impact assessments are key to protecting industrial control systems from such threats.