Skip to content
Threat Actors Target Qlik Sense Servers with Exploits and Reverse Shells

Threat Actors Target Qlik Sense Servers with Exploits and Reverse Shells

First seen 11 Nov 2026, 17:03 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 11, 2026 at 17:09 UTC
  • •Threat actors targeted Qlik Sense servers using multiple CVEs for exploitation.
  • •Vulnerabilities include critical remote code execution flaws with CVSS scores of 9.6.
  • •Organizations are advised to ensure all patches from 2023 are applied immediately.

In October 2026, threat actors attempted to exploit vulnerabilities in Qlik Sense servers, specifically targeting CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365. Cynet's CyOps team detected suspicious activity involving PowerShell reverse shell commands aimed at multiple EU-based customers. The vulnerabilities, which were patched in 2023, allow unauthenticated remote code execution and privilege escalation. Although the reverse shell attempts were blocked, the malware was designed to conduct reconnaissance and establish persistence. The attack method involved a PowerShell command that connected to a remote IP address. This incident has similarities to a previous CACTUS ransomware campaign documented in November 2023. Organizations using Qlik Sense are urged to confirm that all patches have been applied to mitigate these vulnerabilities.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 10h ago How this analysis works

Timeline

2023-08-29
CVE-2023-41265 and CVE-2023-41266 published
Critical vulnerabilities in Qlik Sense Enterprise for Windows were disclosed, allowing unauthenticated remote code execution.
community.qlik.com
2023-11-15
CVE-2023-48365 published
A new critical vulnerability in Qlik Sense was disclosed, resolving an incomplete fix for CVE-2023-41265.
community.qlik.com
2026-10-01
Attack attempts detected
Cynet identified attempts to exploit Qlik Sense servers using PowerShell reverse shell commands against multiple environments.
Thehackernews

More articles in this cluster (5)

Following this threat?

Track cactus and CVE-2023-41265 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (29)

1 / 4

Common questions

Which versions of Qlik Sense are affected?
All versions of Qlik Sense Enterprise for Windows prior to the patches released in 2023 are affected.
How urgent is the response to this threat?
Organizations should apply the necessary patches immediately to prevent exploitation.
What are the main vulnerabilities exploited?
The main vulnerabilities are CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365, all of which allow for critical remote code execution.