Our takeCISA reports active exploitation of CVE-2026-111594 in InterSystems IRIS for Health 2025.3–2026.2. Successful exploitation lets an attacker view transmitted data and log into the device. Patch now.Security Resilience desk
Sources (1)
- cisa_advisories · cisa_advisories
What this means for you — Security leader:Apply the vendor's patch for IRIS for Health 2026.2.0.221, 2026.1.0.235 and 2025.3.0.226 immediately; CISA reports active exploitation of the flaw that lets attackers view credentials in transit and log in.
What this means for you — Lean IT orgs:If you run InterSystems IRIS for Health, update to a fixed version right away. Most lean-IT teams without this system can ignore this one.
What this means for you — MSP:Check every client running InterSystems IRIS for Health and push the vendor patch for versions 2026.2.0.221, 2026.1.0.235 and 2025.3.0.226; CISA lists active exploitation.
What this means for you — Researcher:CISA ICSMA-26-295-01 details an exploitable credential-exposure flaw (CVE-2026-111594) in InterSystems IRIS for Health 2026.2.0.221, 2026.1.0.235 and 2025.3.0.226.