---
id: CVE-2023-41265
title: >-
  An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for
  Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and
  earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and
  earlier all…
summary: >-
  An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for
  Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and
  earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and
  earlier all…
severity: critical
cvss: 9.6
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'
cwe:
  - CWE-444
  - CWE-444
vendor: qlik
product: qlik_sense
affected:
  - qlik_sense = august_2022
  - qlik_sense = february_2023
  - qlik_sense = may_2023
  - qlik_sense = november_2022
published: '2023-08-29'
updated: '2026-08-05'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2023-41265'
references:
  - url: >-
      https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801
    label: cve@mitre.org
  - url: 'https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes'
    label: cve@mitre.org
  - url: >-
      https://community.qlik.com/t5/Official-Support-Articles/Critical-Security-fixes-for-Qlik-Sense-Enterprise-for-Windows/ta-p/2110801
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://community.qlik.com/t5/Release-Notes/tkb-p/ReleaseNotes'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41265
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - kev
  - in-the-wild
  - exploit-available
epss: 0.88215
epssPercentile: 0.99762
kev: true
kevDateAdded: '2023-12-07'
kevDueDate: '2023-12-28'
kevRansomware: true
exploited: true
ingestedAt: '2026-08-05T05:45:57.621Z'
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/praetorian-inc/zeroqlik-detect'
  nuclei:
    - CVE-2023-41265
  checkedAt: '2026-09-23T07:13:25.826Z'
exploitAvailable: true
---

## Overview

An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 and earlier, November 2022 Patch 10 and earlier, and August 2022 Patch 12 and earlier allows a remote attacker to elevate their privilege by tunneling HTTP requests in the raw HTTP request. This allows them to send requests that get executed by the backend server hosting the repository application. This is fixed in August 2023 IR, May 2023 Patch 4, February 2023 Patch 8, November 2022 Patch 11, and August 2022 Patch 13.

## Affected

- `qlik_sense = august_2022`
- `qlik_sense = february_2023`
- `qlik_sense = may_2023`
- `qlik_sense = november_2022`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.