CVE-2026-111594High· 8.1▾ TwilightInterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 25.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
0.2% → 0.2%
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
iris_for_health 2026.2.0.221iris_for_health 2026.1.0.235iris_for_health 2025.3.0.226Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
InterSystems recommends users configure IRIS superserver to require SSL/TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist Note that there are three settings: "Disabled", which means that client communications do not use TLS. "Enabled", which means that client communications may use TLS (but they also may not) and "Required", which forces all client communications to use TLS.
InterSystems documentation explains how to configure the server to require TLS: https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver
For more information about how to configure a system to mitigate this vulnerability, contact InterSystems at their world wide response center: https://wrc.intersystems.com (login required)
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118373Low· 3.7LibreSSL ocspcheck through 4.4.0 Cleartext Transmission of OCSP Requests via url2host()
CVE-2026-115495Medium· 5.7Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket
CVE-2026-116844Medium· 4.8Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P
CVE-2026-70379Medium· 6.5Unauthorized Access to vSolution Matrix RTSP
CVE-2026-116114Low· 3.7Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission
CVE-2026-116105Low· 3.7HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission