CVE-2023-46604
Known exploited · CISA KEV
CVSS 10 CRITICAL: the Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. Known ransomware campaign use. EPSS 100% (100th percentile).
CISA federal remediation date Nov 23 · date passed
Threats & Adversaries
Cynet says it blocked PowerShell reverse-shell attempts against Qlik Sense servers at several EU-based customers in October 2026, during a window of just over three minutes. The same infrastructure reportedly staged an Apache ActiveMQ exploit, Veeam tools, and other backdoor components; Cynet has not established that those tools were used against victims.
A reverse shell makes a server call outward to an attacker-controlled system, opening a remote command session. The Qlik attempts were blocked, so they do not establish a successful foothold. Cynet also says the precise entry point into Qlik Sense is unknown.
For organizations running Qlik alongside ActiveMQ or Veeam, the findings leave the campaign’s reach unresolved: the staged tooling suggests possible alternative routes into other systems, but does not show that those routes were attempted or successful.
1 source · Nov 11
Known exploited · CISA KEV
CVSS 10 CRITICAL: the Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. Known ransomware campaign use. EPSS 100% (100th percentile).
CISA federal remediation date Nov 23 · date passed
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: a deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code… Known ransomware campaign use. EPSS 90% (100th percentile).
CISA federal remediation date Nov 7 · date passed
The Hacker News
Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits
Attackers targeted Qlik Sense servers with blocked PowerShell reverse shell attempts, using infrastructure hosting backdoors and exploits.
originalPart of the PlainSec briefing for 2026-11-12
Every edition of this story: Qlik probes failed as ActiveMQ and Veeam tooling surfaced