CVE-2026-111594
Critical · CVSS 9.2Published 2026-10-22
CVSS
9.2
Critical
EPSS
—
exploit probability
Active Exploit
No
not yet listed
High — patch soon — High severity. Target patch within 7 days.
What is CVE-2026-111594?
InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device.
CVSS Score Explained
CVSS 9.2 is Critical — the highest severity tier. Attackers can likely exploit this remotely with no authentication and cause full system compromise. Patch immediately.
EPSS Exploitation Probability
No EPSS score yet — model needs more data on this CVE.
References & Patches
- ›https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GSA_manage_superserver
- ›https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=ROARS_gsecuring_checklist
- ›https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-295-01.json
- ›https://wrc.intersystems.com
- ›https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
Track vulnerabilities for your stack
Tell us what tech you run — Node.js, Python, Java, nginx, whatever — and get a weekly email when new CVEs affect it.
Recent CVEs
- CVE-2026-92450The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.8.7
- CVE-2026-110243The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root.9.4
- CVE-2026-110491The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device.6.9
- CVE-2026-110825The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.8.7
- CVE-2026-107861The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.9.4
- CVE-2026-97785Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.10.0