- CISA says CVE-2026-111594 in InterSystems IRIS for Health could let an attacker read data in transit and use it to log in. CISA has no report of public attacks.
- InterSystems recommends setting the superserver to 'Required'. 'Enabled' lets clients connect without TLS. Only 'Required' forces all client communication onto TLS.
- Leaders should ask teams which setting each IRIS instance uses, and whether those systems can be reached from business networks or the internet.
A setting that sounds safe but is not
Most people read the word "Enabled" as a good sign. In a new CISA advisory on InterSystems IRIS for Health, it falls short. The lesson here is simple. A switch that allows protection does not provide it.
CISA published the advisory on October 22. It covers CVE-2026-111594. The product serves the Healthcare and Public Health sector. CISA says an attacker could view data as it travels. The attacker could then use that data to log in to the device. Abhinav Agarwal reported the flaw to CISA and InterSystems.
The affected IRIS for Health versions are 2026.2.0.221, 2026.1.0.235 and 2025.3.0.226. At the time of the advisory, CISA had received no report of public attacks aimed at this flaw.
How the flaw works
CISA classes the weakness as CWE-319, cleartext transmission of sensitive information. Cleartext means data that anyone can read. If two systems talk without encryption, anyone who can watch the traffic between them can read it.
Login details may be part of that traffic. If so, the watcher can reuse them. That is the path CISA describes: view the data, then use it to log in.
The standard defense is TLS. It is the encryption used to protect data in transit. InterSystems recommends that customers set the IRIS superserver to require it. The superserver is the part of IRIS that handles client connections.
InterSystems describes three settings for client communications. "Disabled" means clients do not use TLS. "Required" forces every client connection onto TLS. "Enabled" sits in between.
Why the middle setting is the trap
Anything short of "Required" leaves room for clear-text connections. "Disabled" is the obvious case, because nothing is encrypted. "Enabled" is the deceptive one. Under that setting, encryption is optional for client communications. It is allowed. It is not enforced.
This shows how a security review can fail without anyone being careless. A checklist may ask only whether TLS is available. That box can be ticked while some connections still travel in the open. The risk sits in the gap between supported and enforced.
A seatbelt that is fitted but optional protects only the people who buckle it.
What the advisory leaves open
The advisory does not give a severity score. It does not name a fixed version. It does not say which setting ships as the default. It also does not say which of the three settings the flaw depends on. It says only that InterSystems recommends "Required". Those are questions for the vendor.
The mitigation CISA relays is a configuration change, not a patch. InterSystems points customers to its documentation. It also offers its worldwide response center for more help. That center requires a login.
CISA adds its general advice for control systems. Keep devices off the internet. Place them behind firewalls, apart from business networks. If remote access is needed, use a VPN. CISA notes that VPNs can have flaws of their own. It adds that a VPN is only as secure as the devices connected to it.
What to ask this week
Start with inventory. Ask your team whether you run InterSystems IRIS for Health, and which versions. Ask any hosting provider the same question.
Next, ask for the actual superserver TLS setting on each instance. The answer should be one of three words: Disabled, Enabled or Required. A report that says only "TLS configured" does not answer the question.
If the answer is not "Required", ask what would break if it were. Learn that before the change, not after.
Then ask who can reach these systems. If business networks or the internet can reach them, CISA's isolation advice applies. Ask InterSystems about fixed versions through its response center.
In security reviews, "available" and "enforced" are different words. Make sure your reports use the right one.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: CISA.
