CVE-2023-41266: Qlik Sense Enterprise path traversal enables anonymous sessions

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityAlthough CVSS is medium (6.5), the flaw is unauthenticated and network-reachable, is in CISA KEV with known ransomware campaign use, and has a very high EPSS probability.

What it is

Qlik Sense Enterprise for Windows contains a path traversal flaw (CWE-22) in multiple releases up to the listed patch levels. An unauthenticated remote attacker can abuse it to generate an anonymous session and then send HTTP requests to endpoints that should require authorization. It is listed in CISA KEV with known ransomware campaign use, so it warrants urgent attention despite a medium CVSS score.

Impact

An attacker gains an anonymous session and can reach unauthorized HTTP endpoints, giving low-level confidentiality and integrity impact within the Qlik Sense deployment. KEV listing indicates real-world use, including in ransomware campaigns.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The flaw is in the Qlik Sense Enterprise for Windows web/service layer and is triggered by crafted HTTP requests.

Exploitation

CVE-2023-41266 is in CISA KEV (added 2023-12-07, due 2023-12-28) with known ransomware campaign use, and EPSS 30-day probability is 0.84843 (99.7th percentile), indicating active exploitation. No public exploit code details are provided in the record.

What to do

• Apply the vendor fixes: August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, or August 2022 Patch 13, whichever matches your branch.
• If patching cannot be completed immediately, follow the vendor advisory and CISA KEV required action, including discontinuing use if no remediation is available.
• Restrict network exposure of Qlik Sense Enterprise for Windows to trusted networks and block direct internet access to its HTTP endpoints.
• Monitor and review anonymous session creation and access to endpoints that should require authentication.
• Verify no unauthorized sessions or endpoint access occurred before patching, given known ransomware use.

Detection

• Alert on anonymous session creation events in Qlik Sense logs, especially from unexpected source IPs.
• Hunt for HTTP requests containing path traversal sequences (../, encoded variants) targeting Qlik Sense endpoints.
• Correlate Qlik Sense access logs with endpoint paths that normally require authentication.
• Review for post-exploitation activity consistent with ransomware staging on hosts running Qlik Sense Enterprise for Windows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.