Critical 9.6Known exploited (CISA KEV)Published Nov 15, 2023

CVE-2023-48365Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683.

Updated under an hour ago (2026-10-19 08:23 UTC)

Does this affect you?

It affects qlik_sense. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Jan 13, 2025; federal agencies had to remediate by Feb 3, 2025, and it is known to be used in ransomware. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for qlik_sense

Exploited in the last 30 days

Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. Due to improper validation of HTTP headers, a remote attacker is able to elevate their privilege by tunneling HTTP requests, allowing them to execute HTTP requests on the backend server that hosts the repository application. The fixed versions are August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, and November 2021 Patch 17. NOTE: this issue exists because of an incomplete fix for CVE-2023-41265.

CVSS: 9.6 CRITICAL (v3.1, CNA)CVSS:3.1/AC:L/AV:N/A:N/C:H/I:H/PR:L/S:C/UI:N
Weakness (CWE): CWE-444
Known exploited: Added to CISA KEV Jan 13, 2025; federal remediation due Feb 3, 2025; known ransomware useApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
EPSS (exploitation in the next 30 days): 47.45% (percentile 99)
Assigned by: mitre
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

qlik qlik_sense qlik:qlik_sense	august_2022; august_2022; august_2022; august_2022; august_2022; august_2022; august_2022; august_2022; and 84 more ranges	NVD

References

https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/tac-p/2120510vendor-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-48365us-government-resource

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.