CVE-2024-36077

highpriority · track · 0EPSS 0.006 · 46 %ileEUNLRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.55% (46th) EPSS

CVSS 8.8 · high

Is it mine?

9 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · ncsc_nl

EPSS · scored 2026-10-27

Qlik Sense Enterprise for Windows before 14.187.4 allows a remote attacker to elevate their privilege due to improper validation. The attacker can elevate their privilege to the internal system role, which allows them to execute commands on the server. This affects February 2024 Patch 3 (14.173.3 through 14.173.7), November 2023 Patch 8 (14.159.4 through 14.159.13), August 2023 Patch 13 (14.139.3 through 14.139.20), May 2023 Patch 15 (14.129.3 through 14.129.22), February 2023 Patch 13 (14.113.1 through 14.113.18), November 2022 Patch 13 (14.97.2 through 14.97.18), August 2022 Patch 16 (14.78.3 through 14.78.23), and May 2022 Patch 17 (14.67.7 through 14.67.31). This has been fixed in May 2024 (14.187.4), February 2024 Patch 4 (14.173.8), November 2023 Patch 9 (14.159.14), August 2023 Patch 14 (14.139.21), May 2023 Patch 16 (14.129.23), February 2023 Patch 14 (14.113.19), November 2022 Patch 14 (14.97.19), August 2022 Patch 17 (14.78.25), and May 2022 Patch 18 (14.67.34).

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:U/UI:Nsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · cve@mitre.org USexploitability 2.8 · impact 5.9

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-269US

affected products (9)

Products and version ranges known to be affected.

n/a n/a≤ n/aenisa_euvdEU
Qlik Technologies Inc. Qlik Sense EnterpriseAugust 2022 → August 2022 Patch 17fstec_bduRU
Qlik Technologies Inc. Qlik Sense EnterpriseAugust 2023 → August 2023 Patch 14fstec_bduRU
Qlik Technologies Inc. Qlik Sense EnterpriseFebruary 2023 → February 2023 Patch 14fstec_bduRU
Qlik Technologies Inc. Qlik Sense EnterpriseFebruary 2024 → February 2024 Patch 4fstec_bduRU
Qlik Technologies Inc. Qlik Sense EnterpriseMay 2022 → May 2022 Patch 18fstec_bduRU
Qlik Technologies Inc. Qlik Sense EnterpriseMay 2023 → May 2023 Patch 16fstec_bduRU
Qlik Technologies Inc. Qlik Sense EnterpriseNovember 2022 → November 2022 Patch 14fstec_bduRU
Qlik Technologies Inc. Qlik Sense EnterpriseNovember 2023 → November 2023 Patch 9fstec_bduRU

advisories (1)

Vendor and ecosystem advisories describing this.

NCSC-2024-0229Kwetsbaarheid verholpen in QlikSense EnterpriseNL2024-05-22csaf · ncsc_nlNL
Er is een kwetsbaarheid verholpen in QlikSense Enterprise.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu ncsc_nl NVD CVE.org MITRE

published 2024-05-22modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan