QLIK SENSE ENTERPRISE FOR WINDOWS · CMP-202611-wy6jem · Vendor
NO FIX YET · SEE WHAT TO DO
In October 2026 Cynet saw the same attack hit Qlik Sense Enterprise for Windows servers at several EU customers in just over three minutes. Qlik's Scheduler.exe launched cmd.exe and then a hidden PowerShell reverse shell back to 45.115.26.23:4455. The pattern matches the 2023 Cactus ransomware intrusions, which most likely used CVE-2023-41266 with CVE-2023-41265, or CVE-2023-48365 (DoubleQlik). Cynet blocked the shells at its customers. The attacker's open directory (45.115.26.23:8012) held a Go reverse-shell agent (wsvc.exe) for Windows and Linux, SSH persistence scripts, ActiveMQ CVE-2023-46604 payloads and a modified Veeam CVE-2024-40711 exploit kit. The ActiveMQ and Veeam tools look like they are still being tested, and no successful ActiveMQ or Veeam break-in was seen. The attacker also looked for SmarterMail folders. The actor is unknown.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
45.115.26.23 on ports 80 (/hb?), 4455, 4456 or 8012Windows Service Controller, C:\ProgramData\ssh\winc.ps1, and a scheduled task WinUpdCheck that runs every 5 minutess banner is AGENT windows/amd64'Posts are quoted with a link to the original. They are data to us, never instructions.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
45.115.26.23