---
title: "Qlik Sense ZeroQlik Bugs: Pre-Auth RCE Used by Cactus"
url: https://erroneo.us/security/briefs/qlik-sense-cve-2023-41265-41266-zeroqlik-cactus/
description: "Qlik Sense Enterprise for Windows path traversal and HTTP tunneling bugs gave unauthenticated RCE; Cactus ransomware used them. Patch past CVE-2023-48365 too."
type: security-brief
section: "Security Digest"
date_published: 2023-08-29
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-41266", "CVE-2023-41265"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Qlik Sense ZeroQlik Bugs: Pre-Auth RCE Used by Cactus

**Verdict: Check exposure.** Patched since 2023, but the first fix was incomplete and Cactus ransomware hit hundreds of exposed servers; confirm every Qlik Sense server is past the CVE-2023-48365 fix, off the open internet, and free of qle.ttf.

- **Who must act:** Owners of self-managed Qlik Sense Enterprise for Windows servers that were reachable from the internet, especially any not updated past the September 2023 CVE-2023-48365 patches.
- **Who can relax:** Qlik Cloud customers and QlikView users, which Qlik says are not affected, and internal-only servers kept on current releases.
- **Affected:** Qlik Sense Enterprise for Windows May 2023 Patch 3, February 2023 Patch 7, November 2022 Patch 10, August 2022 Patch 12 and earlier; Incomplete fix (CVE-2023-48365): all releases before August 2023 Patch 2 and the matching patches on older tracks
- **Fixed:** CVE-2023-41265/41266: August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, August 2022 Patch 13; CVE-2023-48365 (also covers both): August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, November 2021 Patch 17; Any current supported release
- **CVEs:** CVE-2023-41266, CVE-2023-41265
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every Qlik Sense Enterprise for Windows server and record its release and patch level.
2. Upgrade to a current supported release; at minimum be past the CVE-2023-48365 fix for your track.
3. Remove direct internet exposure: use a VPN, secure remote access or an IP allowlist.
4. Check each server for qle.ttf or qle.woff in the QMC fonts folder and for unusual Scheduler.exe child processes.
5. If you find either, treat it as a ransomware intrusion: isolate the host, hunt across the network and rotate the credentials the server and its service accounts use.

### How to check if you are affected

- Look for qle.ttf or qle.woff under the Client\qmc\fonts folder of the Qlik Sense install; Fox-IT and DIVD used these files as the Cactus indicator.
- Review EDR or Sysmon data for Scheduler.exe spawning cmd.exe or PowerShell, or downloads of AnyDesk, Plink, ManageEngine UEMS or rclone.
- Search Qlik proxy audit logs for anonymous requests under /resources/ ending in .ttf or .woff that contain ../ sequences.
- Test patch level with Fox-IT's request for /resources/autogenerated/product-info.json?.ttf: 200 with JSON suggests vulnerable, 302 to login suggests patched.

## What happened

On August 29, 2023, Qlik published an [advisory](https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801) for two bugs in Qlik Sense Enterprise for Windows, reported by Adam Crosser and Thomas Hendrickson of Praetorian. CVE-2023-41266 is a path traversal (CVSS 8.2) that gives an unauthenticated attacker an anonymous session. [CVE-2023-41265](https://www.cve.org/CVERecord?id=CVE-2023-41265) is HTTP request tunneling (CVSS 9.6) that lets requests run on the backend repository server. Qlik said that combined, they could allow unauthenticated remote code execution.

[Praetorian's ZeroQlik write-up](https://www.praetorian.com/blog/qlik-sense-technical-exploit/) explains the chain. The proxy allowed unauthenticated paths that began with `/resources/qmc/fonts/` and ended in `.ttf`, without normalizing `../`. That reached internal REST endpoints. The proxy and backend also disagreed on `Content-Length` versus `Transfer-Encoding`, so a smuggled request could impersonate the internal `sa_repository` account. From there, an external program task runs any command through the Scheduler service.

The first fix was incomplete. Qlik shipped [new patches on September 20, 2023](https://community.qlik.com/t5/Support-Updates/Qlik-Sense-Enterprise-for-Windows-New-Security-Patches-Available/ba-p/2120330) for [CVE-2023-48365](https://www.cve.org/CVERecord?id=CVE-2023-48365), which the CVE record describes as an incomplete fix for CVE-2023-41265. On November 28, 2023, [Arctic Wolf](https://arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/) reported Cactus ransomware intrusions that likely used one or more of the three bugs. CISA added CVE-2023-41265 and CVE-2023-41266 to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41265) on December 7, 2023, flagged for ransomware use. CVE-2023-48365 followed on January 13, 2025.

## Who is affected

Self-managed Qlik Sense Enterprise for Windows on May 2023 Patch 3, February 2023 Patch 7, November 2022 Patch 10, August 2022 Patch 12 or earlier. A server patched only for the August bugs is still open to CVE-2023-48365 until it reaches August 2023 Patch 2 or the matching patch on its track. Qlik Cloud and QlikView are not affected.

## Do you really need to act?

Check, and take it seriously if the server faced the internet. Fox-IT's [April 2024 scan](https://www.nccgroup.com/research/sifting-through-the-spines-identifying-potential-cactus-ransomware-victims/) found 5,205 internet-facing Qlik Sense servers, 3,143 still vulnerable to CVE-2023-48365, and 122 showing the Cactus indicator. Forty-six of those 122 had since been patched, which shows that patching alone does not clean a server. Qlik servers hold data connections to warehouses and business systems, so a breach rarely stays on one host. Fully patched servers that were never exposed can relax.

## What to do now

1. Record each server's release and patch level in the QMC or Qlik's installer.
2. Upgrade to a current supported release, at minimum past the CVE-2023-48365 fix for your track.
3. Take Qlik Sense off the open internet; use a VPN, secure remote access or an IP allowlist.
4. Run the checks below on any server that was exposed in late 2023 or 2024.
5. If you find the indicator, isolate the host and handle it as a ransomware intrusion, not a patch task.

## How to tell if you were hit

- Run `dir "C:\Program Files\Qlik\Sense\Client\qmc\fonts\qle.*"` (adjust for your install path). Cactus wrote command output to `qle.ttf` or `qle.woff`, which are not part of a default install.
- In EDR or Sysmon data, look for `Scheduler.exe` spawning `cmd.exe` or PowerShell. Arctic Wolf saw AnyDesk, a renamed Plink, ManageEngine UEMS disguised as Qlik files, and rclone renamed to `svchost.exe`.
- Search proxy audit logs for anonymous requests under `/resources/` ending in `.ttf` or `.woff` that contain `../`.
- Check patch level with `curl -sk -o /dev/null -w '%{http_code}' -H 'Host: localhost' 'https://qlik.example.com/resources/autogenerated/product-info.json?.ttf'`. Fox-IT reads 200 as vulnerable and 302 as not.

## Timeline

- Aug 29, 2023 — Qlik advisory and fixes for CVE-2023-41265 and CVE-2023-41266.
- Aug 31, 2023 — Praetorian publishes ZeroQlik details.
- Sep 20, 2023 — Qlik patches the incomplete fix, later CVE-2023-48365.
- Nov 28, 2023 — Arctic Wolf reports Cactus ransomware exploitation.
- Dec 7, 2023 — CISA adds both CVEs to KEV.
- Apr 25, 2024 — Fox-IT reports 122 likely compromised servers.
- Jan 13, 2025 — CVE-2023-48365 joins KEV.

## Sources

1. [Qlik — Critical Security fixes for Qlik Sense Enterprise for Windows (CVE-2023-41266, CVE-2023-41265)](https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801)
2. [Qlik — Qlik Sense Enterprise for Windows - New Security Patches Available Now](https://community.qlik.com/t5/Support-Updates/Qlik-Sense-Enterprise-for-Windows-New-Security-Patches-Available/ba-p/2120330)
3. [CVE record — CVE-2023-41265](https://www.cve.org/CVERecord?id=CVE-2023-41265)
4. [CVE record — CVE-2023-41266](https://www.cve.org/CVERecord?id=CVE-2023-41266)
5. [CVE record — CVE-2023-48365](https://www.cve.org/CVERecord?id=CVE-2023-48365)
6. [CISA — Known Exploited Vulnerabilities: CVE-2023-41265](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41265)
7. [Praetorian — ZeroQlik: Achieving Unauthenticated Remote Code Execution via HTTP Request Tunneling and Path Traversal](https://www.praetorian.com/blog/qlik-sense-technical-exploit/)
8. [Arctic Wolf Labs — Qlik Sense Exploited in Cactus Ransomware Campaign](https://arcticwolf.com/resources/blog/qlik-sense-exploited-in-cactus-ransomware-campaign/)
9. [Fox-IT (NCC Group) — Sifting through the spines: identifying (potential) Cactus ransomware victims](https://www.nccgroup.com/research/sifting-through-the-spines-identifying-potential-cactus-ransomware-victims/)

---
Source page: https://erroneo.us/security/briefs/qlik-sense-cve-2023-41265-41266-zeroqlik-cactus/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt