Vulnary
← back to the feed
Critical· 9.6actively exploitedofficial fix available

CVE-2023-41265

A critical flaw in Qlik Sense Enterprise for Windows lets a remote attacker send specially crafted HTTP requests that are executed by the backend server, giving the attacker elevated privileges. The issue affects versions up to August 2022 Patch 12, February 2023 Patch 7, November 2022 Patch 10, and May 2023 Patch 3. The vendor has released patches that fix the problem.

publishedAug 29, 2023
last modifiedAug 5, 2026
sourcesNVD · CISA-KEV
severity · cvss
9.6
critical · how bad it is
exploitation · epss
84%
100th percentile · chance of exploitation in 30 days
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
auto-deletes from the system
counting…on Sep 4, 2026

An official fix is available, so this entry is kept for 30 days and then removed automatically.

01

Who is affected

Qlik Sense Enterprise for Windows, versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier. Administrators and users of these installations.

02

Real-world impact

An attacker can gain higher privileges on the Qlik Sense server, allowing them to run arbitrary commands or access sensitive data by sending tunneled HTTP requests.

03

Why this severity

The CVSS score of 9.6 reflects that the attack can be launched over the network, requires only low effort, needs minimal privileges, and has no user interaction. The vulnerability changes the scope of the affected component and can compromise confidentiality and integrity, but does not affect availability.

04

What to do about it

official fix available
recommended steps
  1. 01Determine the current Qlik Sense Enterprise for Windows version.
  2. 02Download the appropriate patch (August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, or August 2022 Patch 13) from the vendor.
  3. 03Apply the patch following Qlik’s installation instructions.
  4. 04Restart Qlik Sense services and verify the patch is applied.

NVD-referenced vendor advisory

05

Timeline

  1. Aug 29, 2023 · Aug 29, 2023
    Published
    Disclosed and added to the National Vulnerability Database.
  2. Dec 7, 2023 · Dec 7, 2023
    Confirmed exploited (CISA KEV)
    CISA added it to the Known Exploited Vulnerabilities catalog — attackers are using it in the wild.
  3. Dec 28, 2023 · Dec 28, 2023
    CISA remediation deadline
    Federal agencies are required to remediate by this date.
  4. Aug 5, 2026 · 1d ago
    Advisory updated
    The NVD record was last revised.
  5. Aug 5, 2026 · 1d ago
    Official fix available
    A vendor patch or mitigation now exists — see the remediation steps above.
06

How it’s attacked

Attack vectorNetwork (remote)
Attack complexityLow
Privileges requiredLow
User interactionNone needed
ScopeChanged
Confidentiality impactHigh
Integrity impactHigh
Availability impactNone
07

References & advisories

NVD advisory ↗CISA KEV catalog ↗Search advisories ↗
(ai-assisted) A model wrote this summary from the official data, so double-check it against the source before you act on it. Read the official advisory →
CVE-2023-41265: A critical flaw in Qlik Sense Enterprise for Windows lets a remote att · Vulnary