CISA published ICSMA-26-295-01 on October 22, covering CVE-2026-111594 in InterSystems IRIS for Health. The CVSS v3.1 score is 8.1, high severity, under vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Builds 2025.3.0.226, 2026.1.0.235, and 2026.2.0.221 are listed as known affected.
The flaw is CWE-319, cleartext transmission of sensitive information. IRIS for Health ships with TLS and SSL disabled by default on its superserver connections, the channel between the database engine and the applications that query it. Anyone who can watch that traffic reads it in plain text, then reuses captured credentials to log in as a legitimate user.
IRIS for Health underlies integration engines, clinical data repositories, and the interoperability layer that moves patient records between systems, infrastructure that regulatory affairs teams at device manufacturers rarely see directly but increasingly depend on for post market data flows. A default that ships unencrypted invites any attacker already on the same network segment, which describes most hospital IT environments at some point in their operating life.
There is no patched release. InterSystems's fix is a configuration change: enable and require TLS on the superserver rather than leave it on the default setting. That shifts the entire remediation burden onto whoever deployed the product, and a setting nobody was told was wrong rarely gets revisited on its own schedule. Abhinav Agarwal reported the vulnerability to CISA and InterSystems, and CISA says it has received no report of public exploitation that targets it.
Default off encryption is a familiar failure mode in health IT middleware, not only in bedside devices. The database or integration layer that nobody pictures when they hear medical device often carries more patient data across more systems than the device itself does, and a vendor that ships cleartext as the out of box state puts the burden of fixing it on every hospital that never flips the switch.
Audit every IRIS for Health instance in the environment now, not at the next scheduled maintenance window, and assume any credential that crossed the wire before TLS was enforced is already compromised.