Cyber Security News

Qlik Sense for Windows Vulnerability Allows Remote Code Execution

Qlik has identified critical vulnerabilities in its Qlik Sense Enterprise for Windows software that could lead to remote code execution (RCE) if exploited. Security patches have been released to mitigate these risks and ensure system integrity.

The vulnerabilities, discovered during Qlik’s internal security testing, pose a significant threat to systems running Qlik Sense Enterprise for Windows.

If an attacker successfully exploits these flaws, they could gain control of the server, execute unauthorized commands, and compromise data confidentiality and integrity. Fortunately, there have been no reports of these vulnerabilities being exploited maliciously. However, immediate action is required to mitigate the risks.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar

Vulnerability Details

  1. Remote Code Execution (RCE) via Connectors
    • CVE-pending (QB-29918, QB-29750)
    • Severity: High (CVSS Score: 8.8)
    • Description: Unprivileged users with network access can potentially create connection objects that trigger the execution of arbitrary executable files.
  2. Broken Access Control (BAC)
    • CVE-pending (QB-29586, QB-29864, QB-29482, QB-29802)
    • Severity: High (CVSS Score: 7.5)
    • Description: These vulnerabilities may allow unauthorized users to execute remote commands, risking the availability, integrity, and confidentiality of the system.

Affected Software

VersionImpact
May 2024 Patch 9Vulnerable
February 2024 Patch 13Vulnerable
November 2023 Patch 15Vulnerable
August 2023 Patch 15Vulnerable
May 2023 Patch 17Vulnerable
February 2023 Patch 14Vulnerable

To address these vulnerabilities, users are advised to upgrade to fixed versions of Qlik Sense Enterprise for Windows immediately.

The recommended updates include November 2024 Initial Release, May 2024 Patch 10, February 2024 Patch 14, November 2023 Patch 16, August 2023 Patch 16, May 2023 Patch 18, and February 2023 Patch 15. The patches resolve the issues, ensuring system security and stability.

Additionally, a workaround has been provided for extension and visualization errors by modifying the Repository configuration file. This workaround can be applied before or after the upgrade for those currently facing visualization-related challenges.

To ensure your system is protected against exploitation, download the patched versions from the official Qlik Download page (customer login required).

Customers are strongly encouraged to apply these updates promptly and reach out to Qlik Support if assistance is needed. Prioritizing these fixes will prevent potential compromise of your Qlik Sense Enterprise servers.

Investigate Real-World Malicious Links,Malware & Phishing Attacks With ANY.RUN - Try for Free

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Researchers Simulate DPRK’s Largest Cryptocurrency Heist Through Compromised macOS Developer and AWS Pivoting

Security researchers at Elastic have recreated the intricate details of the February 21, 2025, ByBit…

18 minutes ago

Lampion Banking Malware Uses ClickFix Lures to Steal Banking Credentials

Unit 42 researchers at Palo Alto Networks, a highly targeted malicious campaign orchestrated by the…

25 minutes ago

DragonForce: Emerging Hybrid Cyber Threat in the 2025 Ransomware Landscape

DragonForce has swiftly risen as a formidable player in 2025, embodying a hybrid threat that…

33 minutes ago

Mirai Botnet Actively Targeting GeoVision IoT Devices for Command Injection Exploits

The Akamai Security Intelligence and Response Team (SIRT) has identified active exploitation of command injection…

1 hour ago

IBM Cognos Analytics Security Vulnerability Allowed Unauthorized File Uploads

 IBM has issued a security bulletin addressing two newly discovered, high-severity vulnerabilities in its Cognos…

2 hours ago

Critical AWS Amplify Studio Flaw Allowed Attackers to Execute Arbitrary Code

Amazon Web Services (AWS) has addressed a critical security flaw (CVE-2025-4318) in its AWS Amplify Studio platform,…

2 hours ago