InterSystems Corporation InterSystems IRIS for Health

IRIS for Health is a data platform used for clinical data, interoperability, and health applications. CISA's advisory covers one issue in versions 2026.2.0.221, 2026.1.0.235, and 2025.3.0.226: TLS encryption is turned off by default.

The published vector is network-reachable with no privileges and no user action, so Exploitability reads High. Its Attack Requirements value is "Present," since the attacker has to be positioned on the network path. Blue Goat's method reads Exploitability only from Attack Vector, Privileges Required, and User Interaction, so that doesn't lower the rating. Confidentiality, integrity, and availability impacts are all High. On Blue Goat's security matrix, that's Critical as published.

The published vectors describe the software, not your device. If the service is reachable only on a segmented clinical network or behind authentication, score your own deployment with the CVSS v4.0 environmental metrics before you rate your risk.

Credentials captured in transit can give an attacker the same access as the account they belong to, including to clinical data.

What to check now

1. Check whether your product uses or connects to IRIS for Health in the listed versions.
2. Check the superserver's TLS setting. InterSystems recommends configuring it to require SSL/TLS. There are three settings: "Disabled" means no TLS, "Enabled" means connections may or may not use TLS, and only "Required" forces TLS on every client connection.
3. This is a configuration fix, not a version upgrade. Document the setting your product ships with, and include it in your labeling or deployment guidance if customers manage the server.
4. If you're not affected, record that in a VEX statement with the justification.
5. Re-score the threat, and carry any patient-harm result into your ISO 14971 file.

This analysis is informational. It is based on CISA's published advisory and does not assess any specific manufacturer's device.