CVE-2023-41266: Qlik Sense path traversal that mints an anonymous session
The short version: Qlik Sense Enterprise for Windows has a path-traversal flaw (CVE-2023-41266) that lets an unauthenticated attacker craft a request to generate an anonymous session and send requests to endpoints that should require authentication. On its own it's a foothold; chained with a companion privilege bug (CVE-2023-41265) it became unauthenticated remote code execution, and ransomware crews used it. It's in CISA's KEV catalog. Steady hands — patch, and don't leave Qlik on the open internet.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — foothold on its own; Critical when chained (see below) |
| CVSS v3.1 (NVD) | 6.5 — Medium · AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
| CVSS (CNA) | 8.2 — High · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| EPSS | 82.65% · 99.6th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation due 2023-12-28 |
| Known exploited? | Yes — used by ransomware operators, typically chained with CVE-2023-41265 |
| Vulnerability type | CWE-22 path traversal → unauthenticated anonymous session → access to restricted endpoints |
| Requires authenticated session? | No — pre-authentication |
| Affected | Qlik Sense Enterprise for Windows: Aug 2022 Patch 12 and earlier, Nov 2022 Patch 10 and earlier, Feb 2023 Patch 7 and earlier, May 2023 Patch 3 and earlier |
| Fixed in | Aug 2023 IR · May 2023 Patch 4 · Feb 2023 Patch 8 · Nov 2022 Patch 11 · Aug 2022 Patch 13 |
What you need to know
The bug is a path-traversal issue in how Qlik's backend routes certain requests. By walking outside the intended path, an unauthenticated attacker can reach an endpoint that hands back a valid anonymous session — and with that session they can talk to APIs that were supposed to be behind the login.
That's rarely the end of the story. In the real world, CVE-2023-41266 was paired with CVE-2023-41265, an HTTP request-tunneling flaw that lets an attacker elevate from that anonymous session to privileged actions — the combination yielding remote code execution on the Qlik server. That chain was picked up quickly by ransomware operators.
- It's pre-authentication and internet-reachable. Qlik Sense is a BI platform organizations expose for remote analysts.
- The base score undersells it. NVD's 6.5 reflects the traversal in isolation; the CNA's 8.2 and the real-world chain reflect where it actually goes.
How serious we see it
High — and honestly Critical in the chained, in-the-wild form.
Alone, CVE-2023-41266 is an unauthenticated foothold: an anonymous session and reach into restricted endpoints. That's already worth treating as High. But it was disclosed and exploited alongside CVE-2023-41265, and the pair delivered unauthenticated RCE that ransomware groups leveraged — which is why we don't let the 6.5 lull anyone. The bounded, reassuring part: it affects specific Qlik Sense patch levels, the fixes are published, and exposure is quick to confirm.
Recommendations
Straight from Qlik's advisory and CISA:
- Patch now. Move to Aug 2023 IR / May 2023 Patch 4 / Feb 2023 Patch 8 / Nov 2022 Patch 11 / Aug 2022 Patch 13 or later — and apply the companion fix for CVE-2023-41265 in the same maintenance.
- Hunt for prior use. Review logs for anomalous anonymous sessions, unexpected requests to restricted endpoints, and signs of follow-on activity around the exposure window.
- If you find indicators, respond. Ransomware operators targeted this — investigate for lateral movement, rotate credentials, and rebuild where warranted.
- Harden exposure. Keep Qlik Sense off the open internet where possible; restrict to VPN or trusted networks.
- Confirm your exposure first. Verify whether you run Qlik Sense Enterprise for Windows and which patch level.
How BreachRisk sees it
BreachRisk discovers internet-facing Qlik Sense and QlikView interfaces from little more than your domain, fingerprints the server, and flags exposure tied to this KEV-listed, actively exploited flaw — raised to the top of your results because it's in KEV and because our severity take reflects the chained, real-world impact rather than the 6.5. Where testing is authorized, BreachRisk can safely confirm the traversal responds as vulnerable, turning "this looks like an affected Qlik" into a verified finding.
That continuous, outside-in view is the whole value here: the exposed BI server is already on your map, ranked by how it actually gets used against you.