OTPulse

InterSystems Corporation InterSystems IRIS for Health

Plan PatchCVSS 8.1ICS-CERT ICSMA-26-295-01Oct 22, 2026
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityHigh
User InteractionNone needed
Summary

InterSystems IRIS for Health versions 2025.3.0.226, 2026.1.0.235, and 2026.2.0.221 are vulnerable to credential interception. When the IRIS superserver is configured without mandatory TLS encryption, client communications (including login credentials) are transmitted in plaintext. An attacker with network access can capture this data and use intercepted credentials to authenticate to the server and access the database. The vulnerability exists because the default or current configuration may allow clients to connect without encryption, or may permit (but not require) TLS usage.

What this means
What could happen
An attacker who can intercept network traffic to your IRIS for Health server could capture login credentials and gain unauthorized access to your health data system, potentially allowing them to view or modify patient records and clinical data.
Who's at risk
Healthcare providers and organizations using InterSystems IRIS for Health for electronic health records (EHR), patient data management, and clinical operations. This affects any health system that transmits patient information through IRIS superserver connections.
How it could be exploited
An attacker intercepts unencrypted network traffic between client applications and the IRIS superserver. By reading the transmitted data, they extract login credentials. They then use these credentials to authenticate to the IRIS server and access the database. This requires the server to be configured without TLS encryption enabled.
Prerequisites
  • Network access to the IRIS superserver port (default 51773)
  • Server configured without TLS encryption requirement (Disabled or Enabled mode rather than Required)
  • Client-server communication on an unencrypted network path (e.g., internet-facing, shared network segment)
remotely exploitableno authentication required for initial eavesdroppingtransmits credentials in plaintext when TLS not enforcedaffects health data and patient privacy
Affected products (3)
3 pending
ProductAffected VersionsFix Status
InterSystems IRIS for Health: 2026.2.0.2212026.2.0.221No fix yet
InterSystems IRIS for Health: 2026.1.0.2352026.1.0.235No fix yet
InterSystems IRIS for Health: 2025.3.0.2262025.3.0.226No fix yet
Remediation & Mitigation
0/3
Do now
0/2
WORKAROUNDConfigure IRIS superserver to require TLS encryption: set the SSL/TLS setting to 'Required' rather than 'Enabled' or 'Disabled'
HARDENINGReview current IRIS superserver network connectivity and restrict access to the superserver port (51773) to trusted clients and networks using firewall rules
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HARDENINGVerify all client applications connecting to IRIS are configured to use TLS encryption for their connections
View full CISA ICS-CERT advisory
API: /api/v1/advisories/a593cea7-5b1b-48a2-8da6-f81237aefbaf

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.