CVE-2026-111594criticalCWE-319

CVE-2026-111594: falha crítica em InterSystems IRIS for Health

InterSystems Corporation InterSystems IRIS for Health Cleartext Transmission of Sensitive Information

Publicada em 22 out 2026 · Atualizada em 02 nov 2026

Seguir esta CVE + Monitorar IRIS for Health

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.2epss 0.2%

InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Produtos afetados

InterSystems · IRIS for Health

Referências

https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-295-01.json https://wrc.intersystems.com https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01