Reported October 22, 2026: CISA assigned an 8.1 “High” score to CVE-2026-111594 in InterSystems IRIS for Health. CISA says TLS/SSL is off by default in affected versions, allowing an attacker with network access to view transmitted data and potentially reuse it to log in. InterSystems recommends configuring the IRIS superserver so TLS is “Required,” not merely “Enabled.” CISA reports no known public exploitation.

DomAfina’s take: ask every EHR, interface, HIE and analytics vendor whether your environment runs IRIS for Health, which version, and whether superserver TLS is set to Required. Get written evidence, test connections after the change, and inventory integrations that fail. Do not disable traffic blindly: coordinate the fix so intake, orders, EVV and billing feeds stay available. “Encrypted” should be a verified setting, not a vendor assumption.

Source reviewed: CISA: InterSystems Corporation InterSystems IRIS for Health. The source supports the reported update; the operational recommendations are DomAfina’s analysis.