InterSystems Corporation InterSystems IRIS for Health

First reported by CISA Cybersecurity Advisories, concerning InterSystems Corporation InterSystems, Health, 2026.1.0.235.

2 days ago By HelpMeTrack News Desk Tech & AI

Editorial graphic — no licensed photograph was available for this story.

HelpMeTrack began tracking this technology story after CISA Cybersecurity Advisories reported it on 22 Oct 2026, concerning InterSystems Corporation InterSystems, Health, 2026.1.0.235.

Tracked as CVE-2026-111594, the flaw is rated CRITICAL with a CVSS score of 9.2 out of 10, classified as CWE-319 Cleartext Transmission of Sensitive Information. InterSystems recommends users configure IRIS superserver to require SSL/TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist Note that there are three settings: "Disabled", which means that client communications do not use TLS. "Enabled", which means that client communications may use TLS (but they also may not) and "Required", which forces all client communications to use TLS.

Key facts

CVE: CVE-2026-111594
Severity: CRITICAL (CVSS 9.2/10)
Vulnerability type: CWE-319 Cleartext Transmission of Sensitive Information
Official mitigation: InterSystems recommends users configure IRIS superserver to require SSL/TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist Note that there are three settings: "Disabled", which means that client communications do not use TLS. "Enabled", which means that client communications may use TLS (but they also may not) and "Required", which forces all client communications to use TLS.

Why we're tracking this

We'll keep this page updated as the story develops, with links to the original reporting below.

Development timeline

22 Oct, 11:41 UTC First reported by CISA Cybersecurity Advisories