CVE-2023-41265: Qlik Sense Enterprise HTTP request tunneling privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.9, CISA KEV listing with known ransomware use, and very high EPSS probability make this an urgent patch-first issue.

What it is

Qlik Sense Enterprise for Windows fails to properly handle raw HTTP requests, allowing request tunneling that reaches the backend repository application. A remote attacker with a low-privileged account can abuse this to elevate privileges and execute requests on the backend server. The flaw affects multiple 2022 and 2023 release branches and is fixed in the August 2023 IR and later patches.

Impact

An attacker gains elevated privileges and can execute arbitrary requests against the backend repository service, potentially leading to full compromise of the Qlik Sense environment. Because the scope is changed, impact extends beyond the initially accessed component.

Attack surface

Reachable over the network via crafted raw HTTP requests to the Qlik Sense Enterprise web endpoint. The CVSS vector indicates low privileges are required and no user interaction is needed.

Exploitation

Listed in CISA KEV with known ransomware campaign use and a 30-day EPSS probability of roughly 0.88, indicating active exploitation in the wild. Vendor advisory and US government references confirm the issue is being tracked as exploited.

What to do

• Apply the vendor fix: upgrade to August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, or August 2022 Patch 13, or later.
• If immediate patching is not possible, follow Qlik's mitigation guidance or discontinue use of the affected product per CISA KEV required action.
• Restrict network access to Qlik Sense Enterprise endpoints to trusted users and networks.
• Audit and reduce the number of low-privileged accounts that can reach the Qlik Sense web interface.
• Monitor for and block anomalous raw HTTP requests containing tunneling patterns at the reverse proxy or WAF.

Detection

• Inspect web and proxy logs for malformed or double-encoded HTTP requests and unusual absolute-form request lines targeting Qlik Sense.
• Alert on requests to Qlik Sense backend repository endpoints originating from the web tier outside normal application behavior.
• Correlate Qlik Sense authentication logs for low-privileged accounts performing actions or reaching endpoints beyond their role.
• Hunt for post-exploitation activity such as new administrative accounts, unexpected repository service calls, or ransomware precursor behavior on Qlik Sense hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.