InterSystems IRIS for Health CVE-2026-111594

The required condition is that InterSystems IRIS for Health ships with TLS/SSL encryption turned off by default, so client/superserver traffic is transmitted in cleartext; the attacker must additionally be able to observe or intercept that network traffic (an on-path/man-in-the-middle position), reflected by AT:P in the CVSS 4.0 vector. Exploitation is LIMITED by this interception requirement: an attacker with no visibility into the traffic path cannot exploit it, and the issue is neutralized where operators have followed the InterSystems securing checklist to enable TLS on the superserver and other connections. No special authentication or user interaction is required to capture the data, but credential reuse presupposes that credentials actually traverse the monitored, unencrypted channel.

This is a genuine priority, consistent across signals: the vuln.today decision label is act_now and the flaw was reported by ICS-CERT (icscert) with a CISA ICS medical advisory (ICSMA-26-295-01), reflecting critical-infrastructure/healthcare concern. The CVSS 4.0 base is 9.2 (AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H). Importantly, AT:P signals a present attack requirement - the attacker must be positioned to observe or intercept the cleartext traffic (an on-path/MITM condition), so this is not trivially automatable despite the network vector. There is no CISA KEV listing and no EPSS score in the provided data, so there is no evidence of active or widespread exploitation; EPSS is simply missing, not low. No public exploit or PoC reference is present. In short, high severity driven by full credential/data exposure once intercepted, but real-world exploitation depends on the attacker achieving a network interception position, which tempers urgency relative to a fully remote unauthenticated RCE. Note one tension to verify: the input 4.0 vector carries AT:P (an interception prerequisite) yet AC:L, while the mechanism (cleartext transmission, CWE-319) implies the attacker genuinely needs to be on-path, which this analysis treats as the limiting factor.

An attacker who can observe network traffic between a client and an InterSystems IRIS for Health instance - because TLS/SSL is off by default - captures the unencrypted session, reads transmitted data, and extracts credentials. The attacker then reuses those credentials to authenticate directly to the IRIS device. No public exploit identified at time of analysis; the attack relies on standard passive/on-path interception rather than released exploit code.