Attackers Hit Unpatched Qlik Sense Servers, Trying to Deploy Reverse Shells

Security researchers from Cynet observed threat actors targeting Qlik Sense enterprise servers in October 2026, attempting to deploy PowerShell reverse shells. The attacks, which occurred against several EU-based customers within a three-minute window, appear connected to older campaigns where these same vulnerabilities were exploited by the CACTUS ransomware group to gain initial access and deploy remote management tools.

The attackers attempted to establish a command channel back to a command-and-control server, using a specific IP address and port. While the exact vulnerability used in this latest wave is unknown, the attacks leverage critical flaws in Qlik Sense that were patched in 2023. The takeaway is clear: organizations that have delayed patching these high-severity vulnerabilities, some with maximum CVSS scores of 9.6, remain actively targeted and at severe risk of compromise.

What to do: Patch Qlik Sense Enterprise for Windows to the versions released in August and September 2023 that address CVE-2023-41265, CVE-2023-41266, and CVE-2023-48365.