Is CVE-2023-48365 (Qlik Sense HTTP Tunneling) being exploited in the wild?

Yes. CISA added CVE-2023-48365 to its Known Exploited Vulnerabilities catalogue on 13 January 2025, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. Qlik Sense contains an HTTP tunneling vulnerability that allows an attacker to escalate privileges and execute HTTP requests on the backend server hosting the software.

How to confirm whether CVE-2023-48365 is being used in active attacks

For this question, the practical answer starts with exposure triage, not speculation. Treat the issue as live if the version is present anywhere in your environment, because CISA’s KEV listing is a strong signal that exploitation is not theoretical. Start by inventorying where Qlik Sense is deployed, including internet-facing instances, partner-accessible systems, and any reverse-proxy or tunneling paths that may widen reach.

Use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog to verify the current response expectation, then validate whether your deployment matches the vulnerable product path described by the vendor. If you already have a vulnerability management workflow, the Vulnerability Management Guide is the right place to anchor prioritisation, because KEV status should immediately move this issue ahead of routine scanning backlogs.

What exploitation means for a Qlik Sense HTTP tunneling flaw

An exploited HTTP tunneling flaw is more than a “patch later” problem, because the backend request path can be abused to reach functions that normal users should not control. The direct answer already states the vulnerability can escalate privileges and execute HTTP requests on the backend server, which means compromise may extend beyond the application tier into the hosting environment if an attacker can chain requests or reach sensitive interfaces. In practice, that often changes the incident from a single-product issue into a broader host and identity review.

One useful comparison point is how attackers use exposed service paths after initial access. If the flaw allows backend request execution, the next questions are whether administrative operations, session material, or internal-only endpoints were reachable. The CISA KEV Catalog tells you the vulnerability is operationally important, while the CVE Program is the authoritative place to confirm you are discussing the exact identifier and not a similarly named Qlik issue.

What to do if you cannot patch immediately

If remediation is delayed, the priority is to shrink reachable attack surface and assume the flaw may already have been probed. Restrict access to Qlik Sense as tightly as business allows, remove unnecessary internet exposure, and review any proxy, tunnel, or trust configuration that might make backend request routing easier for an attacker. Temporary mitigations should be treated as compensating controls, not as a substitute for remediation.

Because the KEV catalog is designed for exploited vulnerabilities, a wait-and-see approach is usually the wrong decision. Use the NIST National Vulnerability Database for record-level context, but do not rely on it for prioritisation over KEV status. If the service is externally reachable, the most useful containment step is to narrow who can reach the application while you prepare the fix, then verify whether any backend request traces or unexpected privilege changes appeared during the exposure window.

Risk and Threat Considerations

This vulnerability matters because it sits on a path that can convert application access into higher privilege and backend request execution. That combination makes it attractive for opportunistic exploitation, especially when defenders delay remediation after public disclosure or fail to reduce exposure quickly enough.

Failure mechanism: An attacker abuses the tunneling weakness to reach backend functions that should not be directly reachable, then uses that access to pivot into privileged application behavior or broader server-side activity.

Impact: The likely consequences are privilege escalation, unauthorized backend requests, and a materially higher chance of post-exploitation activity such as persistence, tampering, or broader compromise of the Qlik host.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	KEV-listed exploitation demands prioritised vulnerability tracking and remediation.
Recommendation — Prioritise KEV-listed Qlik Sense exposure for immediate remediation and verification.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerabilities Are Identified and Documented	Exposure confirmation and vulnerability awareness are central to deciding whether exploitation is likely.
	PR.PS-01 — Configuration Management	Reducing reachable attack surface and tightening routing are key mitigations while patching is pending.
Recommendation — Identify affected Qlik Sense assets and document the exposure window for this CVE. Restrict public access and harden routing paths until remediation is complete.
MITRE ATT&CK	T1190 — Exploit Public-Facing Application	This CVE concerns exploitation of an exposed application path to gain backend access.
Recommendation — Hunt for exploitation of the public-facing Qlik Sense path and related follow-on activity.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	KEV status makes timely remediation the core control response to the vulnerability.
Recommendation — Accelerate flaw remediation for Qlik Sense and verify closure after patching.

Practitioner Guidance

What to verify: Confirm whether any Qlik Sense instance is exposed to untrusted networks, whether the affected path is reachable through proxies or tunnels, and whether logs show unusual backend request patterns around the KEV publication date. If you cannot answer those three questions quickly, treat the environment as under-assessed.

Decision rule: If the product is present and reachable, prioritise containment and remediation over extended hunting; if the service is isolated and there is no sign of abuse, you still need to validate exposure and close the gap before returning it to normal priority.

Practitioner takeaway: For KEV-listed issues, “is it being exploited?” is usually answered by exposure plus corroborating telemetry, not by waiting for a local alert. If the service is reachable and the flaw enables backend action, assume the risk is immediate until you have verified otherwise.