Sparx Systems Pro Cloud Server and Enterprise Architect contain five critical…
Sparx Systems Pro Cloud Server and Enterprise Architect contain five critical vulnerabilities enabling SQL injection, authentication bypass, privilege escalation, RCE via race condition, and DoS.
CERT Polska disclosed five vulnerabilities in Sparx Systems software following coordinated disclosure. The most severe issues affect Sparx Pro Cloud Server, including broken access control (CVE-2026-42096) allowing low-privileged users to execute arbitrary SQL queries, and an authentication bypass (CVE-2026-42097) that permits unauthenticated SQL execution by omitting URL parameters and passing model names in POST body data. Additionally, CVE-2026-42098 affects Enterprise Architect clients, enabling authenticated attackers to modify client behavior through debugging and escalate privileges to administrator level.
Pro Cloud Server is also vulnerable to a race condition (CVE-2026-42099) in the artifact download endpoint that can be exploited for remote code execution. An attacker can upload a malicious PHP file which, despite being deleted after processing, remains briefly accessible if response transmission is delayed—creating an exploitable window for code execution. Finally, CVE-2026-42100 allows denial of service through specially crafted SQL queries that crash the Pro Cloud Server service.
Pro Cloud Server version 6.1 (build 167) and below, and Enterprise Architect version 17.1 and below were confirmed vulnerable. The vendor did not provide details on the full range of affected versions, suggesting additional versions may be at risk. Organizations using Sparx Systems products should prioritize patching and implement compensating controls pending vendor guidance.
Mentioned in this report
Detection guidance
Sparx Pro Cloud Server - Suspicious POST Request Without URL Parameters (Potential Auth Bypass)
Detects POST requests to Sparx Pro Cloud Server API endpoints lacking URL query parameters while model/query data is passed only in the body, consistent with the CVE-2026-42097 authentication bypass technique. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Sparx Pro Cloud Server Suspicious POST Without URL Parameters
logsource:
category: proxy
product: windows
detection:
selection:
cs-method: POST
c-uri|contains:
- /api/
- /soap
- /pcs
filter_has_query:
c-uri|contains: '?'
condition: selection and not filter_has_query
falsepositives:
- Legitimate API clients that intentionally omit query strings for non-authenticated
health checks
- Load balancer health probes hitting the same base path
level: medium
tags:
- attack.t1190
id: 1a91b3da-2137-538d-87fa-35ba989e4674
status: experimental
author: Vorant
PHP File Written to Web-Accessible Artifact/Upload Directory by Server Process
Detects creation of a .php file inside an artifact or upload directory served by Pro Cloud Server, matching the CVE-2026-42099 race-condition RCE pattern where a malicious PHP file is briefly accessible before deletion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: PHP File Dropped In Artifact Or Upload Directory
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|endswith: .php
TargetFilename|contains:
- artifact
- upload
- artifacts
- uploads
condition: selection
falsepositives:
- Legitimate PHP-based plugin or extension deployment to the same directory structure
- Administrative maintenance scripts that temporarily stage PHP files during upgrades
level: high
tags:
- attack.t1190
id: db42df36-25b3-53aa-a437-f00ad5bbeaf2
status: experimental
author: Vorant
Web Server Process Spawning Shell Interpreter (Post-Exploitation Command Execution)
Detects a web/application server process (consistent with Pro Cloud Server components) spawning a shell interpreter, indicating command execution following exploitation of a Sparx Systems RCE vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Spawned From Web Application Server Process
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /httpd
- /apache2
- /nginx
- /php-cgi
- /java
Image|endswith:
- /sh
- /bash
- /dash
filter_common_admin:
CommandLine|contains:
- logrotate
- healthcheck
condition: selection and not filter_common_admin
falsepositives:
- Server-side cron or maintenance scripts invoked through the web server's process
group
- Custom application health-check scripts that shell out for status reporting
level: high
tags:
- attack.t1059.004
- attack.t1190
id: a76104d4-7953-5453-95d9-018951fead3a
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-42096
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free