CVE-2023-46604
Known exploited · CISA KEV
CVSS 10 CRITICAL: the Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. Known ransomware campaign use. EPSS 100% (100th percentile).
CISA federal remediation date Nov 23 · date passed
Threats · 1 day ago
Cynet says it blocked PowerShell reverse-shell attempts against Qlik Sense servers at several EU-based customers in October 2026, during a window of just over three minutes. The same infrastructure reportedly staged an Apache ActiveMQ exploit, Veeam tools, and other backdoor components; Cynet has not established that those tools were used against victims.
A reverse shell makes a server call outward to an attacker-controlled system, opening a remote command session. The Qlik attempts were blocked, so they do not establish a successful foothold. Cynet also says the precise entry point into Qlik Sense is unknown.
For organizations running Qlik alongside ActiveMQ or Veeam, the findings leave the campaign’s reach unresolved: the staged tooling suggests possible alternative routes into other systems, but does not show that those routes were attempted or successful.
Known exploited · CISA KEV
CVSS 10 CRITICAL: the Java OpenWire protocol marshaller is vulnerable to Remote Code Execution. Known ransomware campaign use. EPSS 100% (100th percentile).
CISA federal remediation date Nov 23 · date passed
Known exploited · CISA KEV
CVSS 9.8 CRITICAL: a deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code… Known ransomware campaign use. EPSS 90% (100th percentile).
CISA federal remediation date Nov 7 · date passed
1 source covering this story
Hackers Target Qlik Sense Servers With Reverse Shells, Stage ActiveMQ and Veeam Exploits
Attackers targeted Qlik Sense servers with blocked PowerShell reverse shell attempts, using infrastructure hosting backdoors and exploits.
Part of the PlainSec briefing for 2026-11-12