CVE-2023-48365: Qlik Sense Enterprise HTTP Request Smuggling Enables Unauthenticated RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.9, CISA KEV listing with known ransomware use, and high EPSS percentile make this an urgent patching priority.

What it is

Qlik Sense Enterprise for Windows before August 2023 Patch 2 fails to properly validate HTTP headers, allowing HTTP request tunneling to the backend repository server. This is an incomplete fix for CVE-2023-41265, so the earlier patch does not fully close the issue. Successful exploitation leads to remote code execution on the backend host.

Impact

An attacker can tunnel requests past the front end and execute code on the backend server hosting the repository application, gaining control of that system. CISA notes known ransomware campaign use, so impact can extend to data theft and lateral movement.

Attack surface

Reachable over the network via crafted HTTP headers sent to the Qlik Sense web endpoint; the CVSS vector shows no user interaction and low privileges required, though the description calls it unauthenticated. No special access beyond network reachability to the service is needed.

Exploitation

Listed in CISA KEV with a due date of 2025-02-03 and flagged for known ransomware campaign use. EPSS 30-day probability is 0.24491 (97.76th percentile), indicating active exploitation is expected.

What to do

• Apply the vendor's fixed release (August 2023 Patch 2 or later) immediately; if that is not possible, apply the corresponding patch for your branch (May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, or November 2021 Patch 17).
• If patching cannot be completed within the KEV due date, follow CISA guidance to discontinue use of the product until mitigations are available.
• Restrict network access to the Qlik Sense Enterprise web endpoint to trusted networks and users only.
• Review Qlik's advisory for any interim configuration or header-validation mitigations and apply them.
• Monitor for and block anomalous HTTP tunneling or header-manipulation traffic at the perimeter.

Detection

• Inspect HTTP traffic to Qlik Sense for malformed or duplicate headers consistent with request smuggling and tunneling.
• Alert on unexpected outbound connections or process creation on the backend repository server.
• Correlate Qlik Sense web logs with backend server logs for requests that bypass the front end.
• Hunt for known post-exploitation activity tied to ransomware on hosts running Qlik Sense Enterprise.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.