Securing InterSystems IRIS for Health: Mitigating CVE-2026-111594 Cleartext Exposures

Executive Summary

InterSystems Corporation recently disclosed a high-severity security advisory regarding CVE-2026-111594, affecting specific iterations of InterSystems IRIS for Health. The flaw stems from a fundamental configuration baseline: Transport Layer Security and Secure Sockets Layer encryption remain disabled by default on the product's superserver. This oversight leads directly to the cleartext transmission of sensitive data across local and wide-area networks, corresponding to CWE-319. Organizations relying on this medical data platform face significant operational risk if their instances communicate over untrusted networks without explicit encryption hardening. From an external Attack Surface Management perspective, identifying unencrypted administrative and data ports exposed to the public internet is critical to preventing credential harvesting and unauthorized access.

Technical Details

The core vulnerability designated as CVE-2026-111594 impacts InterSystems IRIS for Health versions 2025.3.0.226, 2026.1.0.235, and 2026.2.0.221. InterSystems IRIS serves as a high-performance data platform heavily utilized within healthcare ecosystems to manage fast-moving operational data, electronic medical records, and interoperability pipelines. The superserver component acts as a central listener and connection manager, routing client requests to appropriate database and application namespaces.

By default in the affected releases, this superserver communicates over TCP using unencrypted channels. When clients, administrators, or internal microservices establish a connection, authentication handshakes, session tokens, database queries, and payload contents traverse the wire in plain text. An adversary positioned on the same network segment or capable of intercepting traffic through compromised routing infrastructure can easily sniff the packets. The lack of cryptographic protection violates basic confidentiality principles, allowing malicious actors to harvest administrative credentials and subsequently log directly into affected database instances with elevated privileges.

Exploitation & Risk

The real-world risk associated with CVE-2026-111594 is amplified by the sensitivity of the data managed by IRIS for Health. Healthcare environments process protected health information, patient demographics, and clinical notes. If an instance is inadvertently exposed to the internet or an untrusted internal VLAN without proper network segmentation and encryption, the attack chain is straightforward.

• An attacker performs network reconnaissance to locate open listener ports associated with the InterSystems superserver.

• The adversary captures authentication traffic passing through the unencrypted channel using passive packet capture tools.

• Extracted credentials are replayed or used directly to authenticate against the management or application interfaces.

• Once inside the instance, unauthorized actors can exfiltrate sensitive medical records, manipulate clinical data, or pivot deeper into the corporate network.

Because the flaw does not require complex memory corruption or buffer overflows to exploit, the barrier to entry for attackers is exceptionally low. Simple packet inspection yields immediate administrative access if the default configuration remains untouched.

Remediation & Defense

Mitigating CVE-2026-111594 requires a combination of immediate software updates, strict configuration hardening, and rigorous network defense. Organizations running the affected versions should execute the following steps:

• Apply the official patches and software updates provided by InterSystems Corporation to resolve the underlying configuration behavior.

• Explicitly enforce TLS/SSL encryption across all superserver configurations, ensuring that cleartext fallback options are disabled.

• Implement strict network segmentation, placing database and health platform servers behind dedicated firewalls and preventing direct exposure to the public internet.

• Utilize encrypted VPN tunnels or mutual TLS for any administrative traffic or inter-service communication traversing untrusted network boundaries.

• Conduct internal log reviews to monitor for anomalous connection patterns, unauthorized authentication attempts, and unexpected administrative logins.

How Mangudai Can Help

External Attack Surface Management focuses on identifying how your organization appears to an external adversary before they launch an attack. While automated ASM platforms cannot inspect internal application configuration files directly, modules dedicated to port and service discovery play a vital role in surfacing exposures related to unencrypted databases and management services.

• Mangudai performs comprehensive port scans across your external IP space to locate open listeners associated with database platforms and custom services.

• Our service fingerprinting identifies running software versions and flags banner-based matches that correlate with known advisories like CVE-2026-111594, clearly labeling them as unverified indicators for your security team to investigate.

• Automated checks evaluate whether detected ports enforce secure cryptographic protocols or if they respond to unencrypted connection probes.

• By maintaining continuous visibility over your external perimeter, Mangudai helps security teams rapidly identify forgotten or shadow IT assets running sensitive database software long before an attacker can exploit cleartext transmission flaws.

Sources

• CISA ICS Medical Advisory (ICSMA-26-295-01): https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01