Full Report
CERT Polska has received a report about 5 vulnerabilities (from CVE-2026-42096 to CVE-2026-42100) found in Sparx Systems products: Pro Cloud Server and Enterprise Architect.
Analysis Summary
# Vulnerability: Multiple Flaws in Sparx Systems Pro Cloud Server and Enterprise Architect
## CVE Details
- **CVE ID:** CVE-2026-42096, CVE-2026-42097, CVE-2026-42098, CVE-2026-42099, CVE-2026-42100
- **CVSS Score:** Not explicitly provided (High/Critical potential based on RCE and Auth Bypass)
- **CWE:**
- CWE-863 (Incorrect Authorization)
- CWE-639 (Authorization Bypass Through User-Controlled Key)
- CWE-603 (Use of Client-Side Authentication)
- CWE-362 (Race Condition)
- CWE-228 (Improper Handling of Syntactically Invalid Structure)
## Affected Systems
- **Products:** Sparx Systems Pro Cloud Server and Enterprise Architect
- **Versions:**
- Pro Cloud Server: All versions through 6.1 (Build 167)
- Enterprise Architect: All versions through 17.1
- **Configurations:** Systems utilizing the Pro Cloud Server database communication and the `/data_api/` endpoints.
## Vulnerability Description
Summary of the five identified flaws:
1. **CVE-2026-42096:** Broken access control in database communications allows low-privileged users to execute arbitrary SQL queries.
2. **CVE-2026-42097:** Authentication bypass via URL manipulation. By omitting the "model" query parameter and placing the model name in a binary POST blob, attackers can execute SQL queries unauthenticated.
3. **CVE-2026-42098:** Client-side authentication flaw where role-based limits are enforced by the client rather than the server. Attackers can use a debugger to modify client behavior and log in as any user or administrator.
4. **CVE-2026-42099:** A race condition in the `/data_api/dl_internal_artifact.php` endpoint. Attackers can upload a malicious PHP file that is temporarily stored on the server. By delaying the connection, the attacker can execute the file before it is deleted, leading to **Remote Code Execution (RCE)**.
5. **CVE-2026-42100:** A Denial of Service (DoS) vulnerability where a specially crafted SQL query causes the Pro Cloud Server service to crash.
## Exploitation
- **Status:** PoC described in technical detail; no reported exploitation in the wild at this time.
- **Complexity:** Medium (requires knowledge of PHP race conditions or debugger usage).
- **Attack Vector:** Network.
## Impact
- **Confidentiality:** High (Auth bypass and arbitrary SQL execution).
- **Integrity:** High (Full repository modification and RCE).
- **Availability:** High (Service termination via DoS).
## Remediation
### Patches
As of the publication date, the vendor has not provided specific patch details or confirmed the fixed version range, despite early notification. Users are advised to check the Sparx Systems website for versions higher than 6.1 (Pro Cloud) and 17.1 (Enterprise Architect).
### Workarounds
- **Network Segmentation:** Limit access to the Pro Cloud Server and database to trusted IP addresses only.
- **Disable PHP Execution:** If the web server configuration allows, prevent the execution of PHP scripts in the temporary directories used by the application.
- **Database Hardening:** Apply the principle of least privilege to the service account used by Pro Cloud Server to connect to the database.
## Detection
- **Indicators of Compromise:**
- Unexpected PHP files appearing in the web root or application directories.
- Large files or extremely slow connections held open to `dl_internal_artifact.php`.
- SQL logs showing queries originating from unusual users or containing administrative commands.
- **Detection methods:** Monitor web server error logs for service crashes (DoS) and inspect POST requests for the omission of "model" parameters.
## References
- CERT Polska Advisory: [https://cert.pl/en/posts/2024/05/vulnerabilities-in-sparx-systems-products/](https://cert.pl/en/posts/2024/05/vulnerabilities-in-sparx-systems-products/)
- CVE MITRE: [https://www.cve.org/CVERecord?id=CVE-2026-42096](https://www.cve.org/CVERecord?id=CVE-2026-42096)
- Vendor: [https://sparxsystems.com/](https://sparxsystems.com/)