Thousands of Qlik Sense Servers Open to Cactus Ransomware

Nearly five months after Qlik disclosed CVE-2023-41266, CVE-2023-41265 and the subsequent bypass CVE-2023-48365, security teams observed the Cactus ransomware group exploiting these flaws to gain remote code execution in Qlik Sense; scans identified 5,205 internet-accessible Qlik Sense servers with 3,143 still vulnerable and at least 122 likely compromised, prompting Fox-IT, DIVD, ShadowServer and others to notify affected organizations and warn of a high likelihood of compromise.