Sparx Systems flaws enable RCE, privilege escalation
Five vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect allow SQL injection, authentication bypass, privilege escalation, RCE via race condition, and DoS.
CERT Polska coordinated disclosure of five vulnerabilities affecting Sparx Systems' Pro Cloud Server and Enterprise Architect products. CVE-2026-42096 allows any low-privileged user to execute arbitrary SQL queries due to broken access control in database communications. CVE-2026-42097 enables unauthenticated SQL execution by omitting the model query parameter and sending it in a POST request binary blob instead. CVE-2026-42098 permits authenticated attackers to modify Enterprise Architect client behavior and escalate privileges to any user or administrator account.
CVE-2026-42099 involves a race condition in the /data_api/dl_internal_artifact.php endpoint where attackers with repository access can upload and execute malicious PHP files during a brief window when files remain accessible before deletion. CVE-2026-42100 allows denial of service through specially crafted SQL queries that terminate the Pro Cloud Server unexpectedly. Pro Cloud Server version 6.1 build 167 and below, and Enterprise Architect version 17.1 and below are confirmed vulnerable, though other versions may also be affected.
The vendor was notified early but did not respond with vulnerability details or comprehensive version ranges. The vulnerabilities were discovered by Blazej Adamczyk from Efigo and reported responsibly through CERT Polska's coordinated vulnerability disclosure process.
Mentioned in this report
Detection guidance
Web Server Process Spawning Unix Shell (Possible Pro Cloud Server Webshell Execution)
Detects a web server or PHP-related process spawning an interactive shell, consistent with execution of an uploaded PHP webshell via the dl_internal_artifact.php race condition (CVE-2026-42099). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Web Server Process Spawning Unix Shell
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /php-fpm
- /php-cgi
- /php
- /httpd
- /apache2
- /nginx
shell:
Image|endswith:
- /sh
- /bash
- /dash
condition: selection and shell
falsepositives:
- Legitimate PHP application code that intentionally shells out to system utilities
(e.g. imagemagick, git hooks)
- Custom CGI scripts that call shell utilities as part of normal application logic
level: high
tags:
- attack.t1059.004
- attack.t1190
id: 261c09ad-0183-5965-9012-de5d7608191a
status: experimental
author: Vorant
POST Request to Sparx dl_internal_artifact.php Upload Endpoint
Detects HTTP POST requests to the dl_internal_artifact.php endpoint used in the CVE-2026-42099 race-condition file upload/execute vulnerability and CVE-2026-42097 unauthenticated SQL execution via binary POST blob, which omits the expected model parameter. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious POST to Sparx Pro Cloud Server Artifact Endpoint
logsource:
category: proxy
detection:
selection:
cs-method: POST
cs-uri-stem|contains: /data_api/dl_internal_artifact.php
filter:
cs-uri-query|contains: model=
condition: selection and not filter
falsepositives:
- Legitimate Pro Cloud Server clients uploading artifacts through the normal API with
a valid model parameter
- Automated integration/test clients exercising the artifact API
level: medium
tags:
- attack.t1190
id: ece31c2f-ebd9-5b7a-8875-3add7d83bb4b
status: experimental
author: Vorant
Repeated Unexpected Crash/Restart of Pro Cloud Server Service
Detects repeated Service Control Manager crash/restart events for the Sparx Pro Cloud Server service, consistent with denial-of-service via crafted SQL queries (CVE-2026-42100) that terminate the server process unexpectedly. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Pro Cloud Server Service Unexpected Crash and Restart
logsource:
product: windows
category: system
detection:
selection:
Provider_Name: Service Control Manager
EventID:
- 7031
- 7034
service_filter:
Param1|contains:
- ProCloudServer
- Pro Cloud Server
- Sparx
condition: selection and service_filter
falsepositives:
- Legitimate service crashes due to unrelated resource exhaustion or misconfiguration
on the host
- Planned maintenance restarts that generate similar SCM events
level: medium
tags:
- attack.t1499
id: 6b222e9e-40ea-570a-bdb0-8377f231042e
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-42096
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free