Someone Is Back on Unpatched Qlik Sense Servers, and Their Staging Server Holds ActiveMQ and Veeam Exploits Too. All Five CVEs Have Been on CISA's Exploited List Since 2025 or Earlier
If you run Qlik Sense Enterprise for Windows, confirm you are on Qlik's November 2023 release or a fixed patch of your branch (for example August 2023 Patch 2 or May 2023 Patch 6), and block or alert on outbound traffic to 45.115.26.23. Then check the Apache ActiveMQ and Veeam Backup & Replication servers on the same network, because the operator behind this activity was preparing exploits for both. Every flaw involved has been on CISA's Known Exploited Vulnerabilities catalog for at least ten months, so this is old debt, not a new zero-day.
What has been reported
The primary source is Cynet's report "ZeroQlik Returns: Exploiting N-Days Still Pays Off," which we read through an agent; the page carries no publication date or author and says it was last updated November 11, 2026. The Hacker News covered it the same day. Everything below about the attack is Cynet's account; we did not see the activity ourselves.
What Cynet saw: a PowerShell reverse shell command on Qlik Sense servers at "several EU-based customers," all "within a window of just over three minutes," in October 2026. Cynet does not give the number of customers or the exact date. "The command was executed under scheduler.exe, resembling the 2023 Cactus Qlik intrusions." In one case, "Cynet blocked the script from executing, preventing the reverse shell process from being launched." The report does not say whether a shell succeeded anywhere else.
How they got in is not confirmed. Cynet writes that "it seems likely that the threat actor either utilized a combination of CVE-2023-41266 and CVE-2023-41265 or the later vulnerability CVE-2023-48365," and its technique table says "The exact vulnerability remains unconfirmed."
The reverse shell: a one-line PowerShell shell (based on the public Nishang script) calling back to 45.115.26.23 on port 4455.
The staging server: Cynet found an open directory on the same address, port 8012. Per the report it held a Go backdoor for Windows (wsvc.exe, installed as a service named wsvc, displayed as "Windows Service Controller") and a Linux build, a Bash reverse shell, SSH persistence scripts, exploit material for the Apache ActiveMQ flaw CVE-2023-46604 and a modified public toolchain for the Veeam flaw CVE-2024-40711. Cynet's read: "The threat actor appears to be currently testing the ActiveMQ and Veeam exploits, as these tools were not production-ready." It says no customer was successfully exploited through ActiveMQ and it did not observe a successful Veeam exploitation.
Persistence, from Cynet's lab run of the toolkit: a scheduled task named WinUpdCheck that runs C:\ProgramData\ssh\winc.ps1 every five minutes; installation of OpenSSH from a legitimate OpenSSH-Win64.zip package ("a legitimate OpenSSH package reused by the operator"), sshd set to start automatically, an inbound firewall rule for TCP 22, and an operator key in C:\ProgramData\ssh\administrators_authorized_keys. The Go agent checks in over HTTP to /hb on the same address with the computer name and user name in the query string, and talks on port 4456.
The CACTUS link is a resemblance, not an attribution. Cynet compares the process tree to the CACTUS ransomware campaign Arctic Wolf reported in November 2023, in which "Qlik Sense Scheduler.exe spawned cmd.exe and PowerShell." Cynet does not say the same group is behind this.
The five CVEs, with dates from CISA's catalog
Dates below come from the CISA KEV JSON (catalog version 2026.11.10), not from press. All five are marked as known to be used in ransomware campaigns.
CVE-2023-41265, Qlik Sense HTTP tunneling: added Thursday, December 7, 2023, due Thursday, December 28, 2023.
CVE-2023-41266, Qlik Sense path traversal: added Thursday, December 7, 2023, due Thursday, December 28, 2023.
CVE-2023-48365, Qlik Sense HTTP tunneling ("DoubleQlik", Qlik calls it the fix for an incomplete fix of CVE-2023-41265): added Monday, January 13, 2025, due Monday, February 3, 2025.
CVE-2023-46604, Apache ActiveMQ deserialization: added Thursday, November 2, 2023, due Thursday, November 23, 2023.
CVE-2024-40711, Veeam Backup & Replication deserialization: added Thursday, October 17, 2024, due Thursday, November 7, 2024.
Qlik's advisory for CVE-2023-48365 lists the affected releases as everything up to and including August 2023 Patch 1, May 2023 Patch 5, February 2023 Patch 9, November 2022 Patch 11, August 2022 Patch 13, May 2022 Patch 15, February 2022 Patch 14 and November 2021 Patch 16. Fixed: November 2023 and later, or August 2023 Patch 2, May 2023 Patch 6, February 2023 Patch 10, November 2022 Patch 12, August 2022 Patch 14, May 2022 Patch 16, February 2022 Patch 15, November 2021 Patch 17. Those patches also carry the fixes for the two earlier CVEs. Qlik lists no workaround.
What it means
Three years after CACTUS used these exact Qlik bugs, someone found enough unpatched Qlik Sense servers in European companies to hit several of them in three minutes. The toolkit is the warning: an operator who lands on a Qlik server is lining up the next two hops, the message broker and the backup server. A backup server is where ransomware crews go to make sure you cannot restore.
What to do
Patch Qlik Sense to a fixed release from the list above. If you cannot, take the server off the internet; Qlik offers no workaround.
Hunt on Qlik Sense hosts for PowerShell or cmd.exe launched by Qlik's scheduler.exe, a service named wsvc or "Windows Service Controller", C:\Windows\Temp\wsvc.exe, a scheduled task named WinUpdCheck, C:\ProgramData\ssh\winc.ps1, an unexpected OpenSSH server install, a new inbound rule for TCP 22, and an unknown key in C:\ProgramData\ssh\administrators_authorized_keys.
Block and search egress to 45.115.26.23, especially ports 80, 4455, 4456, 4457 and 8012.
Patch ActiveMQ against CVE-2023-46604 and Veeam Backup & Replication against CVE-2024-40711, per each vendor's advisory, and keep both off the internet. Apache's and Veeam's fixed versions are in their advisories; we did not re-read them for this post.
If a Qlik server was exposed and unpatched, treat it as possibly compromised: rotate credentials it held and check whether it can reach your backup and messaging servers.
Indicators
Published by Cynet, credited to Cynet, not observed by us:
IP address 45.115.26.23 (reverse shell 4455/tcp, Go agent 4456, Bash agent 4457, HTTP check-in /hb on 80, staging directory on 8012).
SHA256 24ee79a519839230377585ec541863b1615286736cbeb98125afeb82d91bb768 and 1ff457d643e5246efb04861169153402345d50b0bb296443b93a87790909efd5, two persist.ps1 variants Cynet found by searching on the operator's SSH public key.
SSH key fingerprint SHA256:Fl1zSuSZvRomXoyHnR7zfn3ZE9TzE+vg3xxWaQFfzeE, key comment "node6-sm".
File names: wsvc.exe, wsvc_old.exe, wsvc_win_v2.exe, wsvc_linux_full, bagent.sh, persist.ps1, winc.ps1.
What is not known
Which Qlik flaw was used. How many organizations were hit and whether any shell ran to completion outside the one Cynet says it blocked. Who the operator is. Whether the ActiveMQ and Veeam exploits have since been finished and used. The exact October date.
How we know, and how we checked
We read Cynet's report and Qlik's CVE-2023-48365 advisory through agents (Cynet's site refused a direct download), and The Hacker News article. KEV dates come from CISA's JSON file. Weekdays were computed, not copied.
Feed: we added the IP and the two hashes above to our indicator feed, tagged as Cynet's research. The IP was already in our published feed at confidence 80 from a convergence of third-party lanes that included abuse.ch URLhaus's October 18 listing, and ThreatFox had listed one of the two hashes on October 21; both are other parties' work, and we add Cynet's attribution to them. We did not add the SSH key, file names or the loopback address in Cynet's Veeam test artifact, which are not network-blockable indicators.
Edge check: we run no Qlik Sense, ActiveMQ or Veeam. Our edge blocks (281,160 blocked requests since September 1), edge decoys (96,502 hits) and origin honeypot (2,276 captures) show zero requests to Qlik Sense paths (/resources/qmc/, /qrs/, /qps/, /qmc) and zero from 45.115.26.23 in the same window. We have no decoy built for Qlik, so that zero means this activity did not touch our web zones, not that nobody is scanning for Qlik. Our exploit-code collector holds no public proof-of-concept repository under CVE-2023-48365.
Sources
Cynet, "ZeroQlik Returns: Exploiting N-Days Still Pays Off," cynet.com/security-foundations/attack-techniques/exploiting-Qlik-Sense-servers/, last updated November 11, 2026. Qlik, "Critical Security fixes for Qlik Sense Enterprise for Windows" (CVE-2023-48365). CISA Known Exploited Vulnerabilities catalog JSON, version 2026.11.10. The Hacker News, "Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits," November 11, 2026. Arctic Wolf's November 2023 CACTUS report, as cited by Cynet.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments