CVE-2026-111594CWE-319

CVE-2026-111594

High · published October 23, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00183 · 7.5th percentile
Weakness
CWE-319 · Cleartext Transmission of Sensitive Information
Published
2026-10-23T02:18Z
References (5)
https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver · [email protected]https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist · [email protected]https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-295-01.json · [email protected]https://wrc.intersystems.com · [email protected]https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01 · [email protected]
EPSS history
Timeline
  • 24 OCT 03:52Z
    EPSS moved — → 0%
    epss
  • 22 OCT 21:39Z
    InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information
    cvelistv5
  • 22 OCT 21:39Z
    InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information
    cvelistv5