// AI threat desk · 27 Oct 2026
Home/CVE · Vulns & Patches
Vulns & PatchesMediumCVECVSS not assigned

InterSystems IRIS for Health flaw could expose data and log in

CISA said a vulnerability in three InterSystems IRIS for Health versions could expose transmitted data and let an attacker log into a device. It disclosed the issue Oct 22, 2026.

· 2 min read
AI-generated image of a technician inspecting hospital servers beside a workstation with blurred security dashboards.
AI-generated image, not a photo of the event.
Key takeaways
  • CVE-2026-111594 affects three InterSystems IRIS for Health versions.
  • Successful exploitation could expose transmitted data and let an attacker use it to log into the device.
  • CISA said no known public exploitation specifically targeting the vulnerability had been reported at the time of its advisory.

CISA published an advisory on Oct 22, 2026, for a vulnerability affecting InterSystems IRIS for Health. Successful exploitation could let an attacker view transmitted data and use that data to log into the device.

The product is deployed worldwide, and CISA identified healthcare and public health as critical infrastructure sectors affected by the vulnerability. CISA said no known public exploitation specifically targeting the issue had been reported at the time of its advisory.

CISA classified the issue as cleartext transmission of sensitive information. InterSystems IRIS for Health is described as a unified data platform that combines analytical and transaction processing with native interoperability for all data types.

On this page

CISA classifies the flaw as cleartext data exposure

CISA classified the vulnerability as cleartext transmission of sensitive information. The agency said successful exploitation could allow an attacker to view transmitted data and use that data to log into the device.

The product is deployed worldwide, while healthcare and public health are the critical infrastructure sectors identified in the advisory.

InterSystems recommends SSL/TLS for the IRIS superserver

Abhinav Agarwal reported the vulnerability to CISA and InterSystems Corporation. CISA published the advisory on Oct 22, 2026.

InterSystems is described as a vendor of database, application development, integration and healthcare information systems. Nasdaq described IRIS for Health as a unified data platform combining analytical and transaction processing with native interoperability for all data types.

InterSystems recommends that users configure the IRIS superserver to require SSL/TLS, according to the CISA advisory.

Abhinav Agarwal reported the vulnerability to CISA and InterSystems Corporation. CISA’s advisory did not report known public exploitation specifically targeting the issue at the time of publication.

FAQ

What happened with InterSystems IRIS for Health?

CISA published an advisory for a cleartext transmission of sensitive information vulnerability affecting three IRIS for Health versions.

Which sectors are affected by the IRIS for Health vulnerability?

CISA identified healthcare and public health as affected critical infrastructure sectors, and said the product is deployed worldwide.

What could an attacker do with the vulnerability?

Successful exploitation could let an attacker view transmitted data and use that data to log into the device.

Has the IRIS for Health vulnerability been exploited?

CISA said no known public exploitation specifically targeting the vulnerability had been reported at the time of its advisory.

How should users configure InterSystems IRIS for Health?

CISA said InterSystems recommends configuring the IRIS superserver to require SSL/TLS.

Sources

  1. InterSystems Corporation InterSystems IRIS for Health, CISAPrimary
  2. InterSystems and Virtusa Corporation Partner to Enhance Patient Data Integration Capabilities, Nasdaq
  3. InterSystems expands the InterSystems Iris data platform with Vector Search to support next-generation AI applications, ITWire
  4. InterSystems, Wikipedia
How we checked this story
ClaimSourceStatus
CISA said successful exploitation could let an attacker view transmitted data and use it to log into the device.CISAConfirmed
CISA said InterSystems IRIS for Health versions 2026.2.0.221, 2026.1.0.235, and 2025.3.0.226 are affected.CISAConfirmed
CISA classified the issue as cleartext transmission of sensitive information.CISAConfirmed
CISA identified healthcare and public health as critical infrastructure sectors affected by the vulnerability.CISAConfirmed
CISA said the affected product is deployed worldwide and its company headquarters are in the United States.CISAConfirmed
CISA said Abhinav Agarwal reported the vulnerability to CISA and InterSystems Corporation.CISAConfirmed
CISA said no known public exploitation specifically targeting the vulnerability had been reported at that time.CISAConfirmed
CISA published the advisory on October 22, 2026.CISAConfirmed
Nasdaq described InterSystems as a global leader in information technology platforms for health, business, and government applications.InterSystems, via NasdaqAttributed
Nasdaq said InterSystems IRIS for Health is a unified data platform combining analytical and transaction processing with native interoperability for all data types.InterSystems, via NasdaqAttributed
Wikipedia describes InterSystems as a privately held vendor of database, application development, integration, and healthcare information systems.WikipediaConfirmed
CISA published its report on Oct 22, 2026.CISAConfirmed

Could not verify

  • Whether the vulnerability was exploited before the advisory is not established.
  • How many InterSystems IRIS for Health deployments are affected is not established.
  • Whether a software fix beyond the SSL/TLS configuration was available is not established.
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok