InterSystems Corporation InterSystems IRIS for Health
Summary
InterSystems IRIS for Health versions 2026.2.0.221, 2026.1.0.235, and 2025.3.0.226 are affected by a vulnerability where TLS/SSL encryption is off by default. Successful exploitation could allow an attacker to view transmitted data and log into the device.
IFF Assessment
The vulnerability allows attackers to intercept sensitive data and gain unauthorized access to devices, posing a significant risk to defenders.
Severity
The CVSS score of 8.1 (high) is assigned due to the cleartext transmission of sensitive information, which allows attackers to view transmitted data and subsequently log into the device, indicating a significant impact on confidentiality and integrity.
Defender Context
This alert highlights a critical vulnerability in healthcare infrastructure software, where cleartext transmission of sensitive information can lead to data interception and unauthorized access. Defenders should prioritize patching and implementing the recommended mitigation of enforcing TLS/SSL encryption on InterSystems IRIS for Health deployments.