Sparx Enterprise Architect critical flaws enable RCE and injection
Sparx Systems Pro Cloud Server and Enterprise Architect contain five critical vulnerabilities enabling SQL injection, authentication bypass, privilege escalation, RCE via race condition, and DoS.
Sourcecert.pl — open the original
What to check
- Applies to
- The 5 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT Polska disclosed five vulnerabilities in Sparx Systems software following coordinated disclosure. The most severe issues affect Sparx Pro Cloud Server, including broken access control (CVE-2026-42096) allowing low-privileged users to execute arbitrary SQL queries, and an authentication bypass (CVE-2026-42097) that permits unauthenticated SQL execution by omitting URL parameters and passing model names in POST body data. Additionally, CVE-2026-42098 affects Enterprise Architect clients, enabling authenticated attackers to modify client behavior through debugging and escalate privileges to administrator level.
Pro Cloud Server is also vulnerable to a race condition (CVE-2026-42099) in the artifact download endpoint that can be exploited for remote code execution. An attacker can upload a malicious PHP file which, despite being deleted after processing, remains briefly accessible if response transmission is delayed—creating an exploitable window for code execution. Finally, CVE-2026-42100 allows denial of service through specially crafted SQL queries that crash the Pro Cloud Server service.
Pro Cloud Server version 6.1 (build 167) and below, and Enterprise Architect version 17.1 and below were confirmed vulnerable. The vendor did not provide details on the full range of affected versions, suggesting additional versions may be at risk. Organizations using Sparx Systems products should prioritize patching and implement compensating controls pending vendor guidance.
Mentioned in this report
Detection guidance
Sparx Pro Cloud Server - Suspicious POST Request Without URL Parameters (Potential Auth Bypass)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects POST requests to Sparx Pro Cloud Server API endpoints lacking URL query parameters while model/query data is passed only in the body, consistent with the CVE-2026-42097 authentication bypass technique. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Sparx Pro Cloud Server Suspicious POST Without URL Parameters
logsource:
category: proxy
detection:
selection:
cs-method: POST
c-uri|contains:
- /api/
- /soap
- /pcs
filter_has_query:
c-uri|contains: '?'
condition: selection and not filter_has_query
falsepositives:
- Legitimate API clients that intentionally omit query strings for non-authenticated
health checks
- Load balancer health probes hitting the same base path
level: medium
tags:
- attack.t1190
id: 1a91b3da-2137-538d-87fa-35ba989e4674
status: experimental
author: Vorant
PHP File Written to Web-Accessible Artifact/Upload Directory by Server Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects creation of a .php file inside an artifact or upload directory served by Pro Cloud Server, matching the CVE-2026-42099 race-condition RCE pattern where a malicious PHP file is briefly accessible before deletion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP File Dropped In Artifact Or Upload Directory
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith: .php
TargetFilename|contains:
- artifact
- upload
- artifacts
- uploads
condition: selection
falsepositives:
- Legitimate PHP-based plugin or extension deployment to the same directory structure
- Administrative maintenance scripts that temporarily stage PHP files during upgrades
level: high
tags:
- attack.t1190
id: db42df36-25b3-53aa-a437-f00ad5bbeaf2
status: experimental
author: Vorant
Web Server Process Spawning Shell Interpreter (Post-Exploitation Command Execution)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a web/application server process (consistent with Pro Cloud Server components) spawning a shell interpreter, indicating command execution following exploitation of a Sparx Systems RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned From Web Application Server Process
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-cgi
- /java
Image|endswith:
- /sh
- /bash
- /dash
filter_common_admin:
CommandLine|contains:
- logrotate
- healthcheck
condition: selection and not filter_common_admin
falsepositives:
- Server-side cron or maintenance scripts invoked through the web server's process
group
- Custom application health-check scripts that shell out for status reporting
level: high
tags:
- attack.t1059.004
- attack.t1190
id: a76104d4-7953-5453-95d9-018951fead3a
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-42096
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs