CVE-2026-111594: InterSystems IRIS for Health Ships With TLS Disabled by Default — Detection and Hardening Guide

---
title: Cleartext InterSystems IRIS Superserver or Web Traffic Detected
id: 3f8a1c92-7b4d-4e6f-a1c3-9d2e5f8b7a01
status: experimental
description: Detects network connections to InterSystems IRIS for Health default ports (Superserver 1972, Web Gateway 52773) where TLS is not in use, indicating cleartext transmission of credentials or PHI consistent with CVE-2026-111594 exposure.
references:
  - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
  - https://cwe.mitre.org/data/definitions/319.html
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.collection
  - attack.t1040
  - attack.credential_access
logsource:
  category: network_connection
detection:
  selection_ports:
    DestinationPort:
      - 1972
      - 52773
      - 51773
  filter_tls:
    tls_established: true
  condition: selection_ports and not filter_tls
falsepositives:
  - Legacy integrations still in migration to TLS — these must be tracked as findings, not exceptions
  - Loopback-only listeners (bound to 127.0.0.1) do not traverse the network and can be excluded after validation
level: high
---
title: Packet Capture or Network Sniffing Tool Executed on Clinical Network Segment
id: 8b2e4d17-6c9a-4f3b-b5e2-1a7d9c4f6e23
status: experimental
description: Detects execution of packet capture utilities capable of intercepting cleartext IRIS for Health traffic, including credential capture against unencrypted Superserver sessions.
references:
  - https://attack.mitre.org/techniques/T1040/
  - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.credential_access
  - attack.t1040
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\wireshark.exe'
      - '\tshark.exe'
      - '\dumpcap.exe'
      - '\windump.exe'
      - '\tcpdump.exe'
      - '\pktmon.exe'
      - '\netsh.exe'
  selection_cli:
    CommandLine|contains:
      - 'trace start'
      - 'pktmon start'
      - '-i any'
      - 'promiscuous'
  condition: selection_img and selection_cli
falsepositives:
  - Network engineering troubleshooting — require change-ticket correlation before tuning out
  - Approved packet brokers and NDR sensors run as services, not interactive CLI sessions
level: medium
---
title: New Administrative or Service Login to IRIS Management Portal From Unusual Source
id: 5c1f7a48-2e8b-4d9c-a3f6-8b4e1c7d2a95
status: experimental
description: Detects authentication to the IRIS for Health Management Portal or Superserver from source addresses outside the defined administrative jump-host or interface-engine allowlist — a potential indicator of replayed credentials harvested from cleartext sessions.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-295-01
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.initial_access
  - attack.t1078
logsource:
  category: network_connection
detection:
  selection:
    DestinationPort:
      - 52773
      - 1972
  filter_approved:
    SourceIp|cidr:
      - '10.10.5.0/28'
      - '10.10.8.0/24'
  condition: selection and not filter_approved
falsepositives:
  - New interface engines or clinical applications onboarded without updating the allowlist
level: high

// Hunt for cleartext connections to IRIS for Health listeners ingested via CEF/Syslog from firewalls/NDR
// Tune ApprovedSources to your actual jump hosts, interface engines (e.g., Cloverleaf, Rhapsody, Mirth), and app servers
let IRISPorts = dynamic([1972, 52773, 51773]);
let ApprovedSources = dynamic(["10.10.5.10", "10.10.8.15", "10.10.8.16"]);
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (IRISPorts)
| where DeviceAction !in ("deny", "drop", "blocked")
| where SourceIP !in (ApprovedSources)
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by SourceIP, DestinationIP, DestinationPort, DeviceProduct
| order by ConnectionCount desc;
// Correlate: authentication events on IRIS hosts following network exposure windows
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4624 and LogonType in (3, 10)
| where IpAddress !in (ApprovedSources)
| summarize LogonCount = count() by Computer, Account, IpAddress, LogonType
| order by LogonCount desc;

-- Inventory IRIS for Health hosts for unencrypted listeners on default ports
-- Run against IRIS server endpoints to validate whether Superserver/Web Gateway
-- are exposed without TLS and which processes hold the sockets
SELECT Pid, Name, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE LocalPort in (1972, 52773, 51773)
  AND Status =~ 'LISTEN'

-- Identify the owning binaries to confirm IRIS processes (irisdb/ISCAgent on Linux, irisdb.exe on Windows)
SELECT Pid, Name, Exe, CommandLine, Username
FROM pslist()
WHERE Name =~ 'iris|ISCAgent|cache'

# Audit IRIS for Health TLS posture and report findings - run on IRIS Windows hosts
# Validates listening ports, checks TLS configuration registry keys, and flags exposure

$irisPorts = @(1972, 52773, 51773)
$report = @()

Write-Host "=== InterSystems IRIS for Health TLS Exposure Audit ===" -ForegroundColor Cyan

# 1. Enumerate listening IRIS ports and owning processes
foreach ($port in $irisPorts) {
    $listeners = Get-NetTCPConnection -LocalPort $port -State Listen -ErrorAction SilentlyContinue
    foreach ($l in $listeners) {
        $proc = Get-Process -Id $l.OwningProcess -ErrorAction SilentlyContinue
        $bindScope = if ($l.LocalAddress -in @('0.0.0.0','::')) { 'EXPOSED-ALL-INTERFACES' } else { "Bound to $($l.LocalAddress)" }
        $report += [PSCustomObject]@{
            Port          = $port
            Process       = $proc.ProcessName
            PID           = $l.OwningProcess
            Binding       = $bindScope
            Finding       = if ($bindScope -eq 'EXPOSED-ALL-INTERFACES') { 'REVIEW: cleartext listener reachable network-wide' } else { 'Bound locally - lower risk' }
        }
    }
}

# 2. Check for IRIS instance configuration - query iris list for installed instances
$irisCmd = Get-Command iris -ErrorAction SilentlyContinue
if ($irisCmd) {
    Write-Host "`nInstalled IRIS instances:" -ForegroundColor Yellow
    iris list 2>$null
    Write-Host "`nACTION: For each instance, verify %SuperServer and Web Gateway TLS settings via:"
    Write-Host "  Management Portal > System Administration > Security > SSL/TLS Configurations"
    Write-Host "  Confirm 'Enabled' = Yes for %SuperServer/TLS and all Web Server connections use HTTPS`n"
} else {
    Write-Host "IRIS CLI not found on this host - verify manually on IRIS servers." -ForegroundColor Yellow
}

# 3. Export findings
$report | Format-Table -AutoSize
$report | Export-Csv -Path "C:\IRIS_TLS_Audit_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Write-Host "Report exported. Any EXPOSED-ALL-INTERFACES finding on a production IRIS host without TLS enabled is a CVE-2026-111594 exposure." -ForegroundColor Red

#!/bin/bash
# Audit IRIS for Health listeners and TLS posture on Linux IRIS hosts
# Run as root or with sudo on each IRIS server

echo "=== IRIS for Health Cleartext Exposure Audit (CVE-2026-111594) ==="

echo "--- [1] Listening IRIS ports (1972 Superserver, 52773 Web Gateway, 51773) ---"
ss -tlnp | grep -E ':(1972|52773|51773)' || echo "No IRIS listeners found on this host"

echo ""
echo "--- [2] IRIS instances installed ---"
iris list 2>/dev/null || /usr/bin/iris list 2>/dev/null || echo "iris CLI not in PATH - check /usr/irissys/bin"

echo ""
echo "--- [3] Check for cleartext captures in flight (evidence of sniffing on this host) ---"
ps aux | grep -E 'tcpdump|tshark|wireshark|dumpcap' | grep -v grep || echo "No capture tools running"

echo ""
echo "--- [4] Verify TLS is enforced: inspect IRIS SSL configurations ---"
echo "Run inside iris session:  iris session <INSTANCE>"
echo "Then execute:"
echo '  Do ##class(Security.SSLConfigs).List()' 
echo "Confirm the Superserver and Web Gateway reference an enabled TLS configuration."

echo ""
echo "--- [5] Restrict Management Portal to admin subnet via host firewall (interim control) ---"
echo "Example: iptables -A INPUT -p tcp --dport 52773 -s 10.10.5.0/28 -j ACCEPT"
echo "         iptables -A INPUT -p tcp --dport 52773 -j DROP"

echo ""
echo "REMEDIATION: Enable TLS on Superserver, Web Gateway, and all interoperability"
echo "listeners per InterSystems advisory ICSMA-26-295-01. Never expose 52773 or 1972"
echo "to untrusted segments without TLS enforced."