PT-2026-41893 · Sparx Systems · Sparx Pro Cloud Server

Published 2026-05-19 · Updated 2026-06-02 · CVE-2026-42097

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Sparx Pro Cloud Server versions 6.1 (build 167) and earlier

Description Authentication is required based on the requested URL. An attacker can bypass this check by omitting the model query parameter and providing the model name only within the binary blob of a POST request, which allows for unauthenticated SQL query execution. This may lead to unauthorized database access and data manipulation.

Recommendations Restrict external exposure of the server to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-42097

Affected Products

Sparx Pro Cloud Server

References · 9

• 🔥 https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-42097 · Security Note
• https://twitter.com/CCBalert/status/2057376285249142850 · Twitter Post
• https://cert.pl/en/posts/2026/05/CVE-2026-42096 · Note
• https://sparxsystems.com/products/procloudserver · Note
• https://twitter.com/UpwindMDR/status/2056865474269364605 · Twitter Post
• https://twitter.com/dailycve/status/2061854907682939363 · Twitter Post
• https://efigo.pl/blog/CVE-2026-42096 · Note
• https://twitter.com/CVEnew/status/2056870238432448704 · Twitter Post