Sparx EA & Pro Cloud Server Auth Bypass, RCE & SQLi Vulnerabilities

Summary of Multiple Vulnerabilities in Sparx Pro Cloud Server and Enterprise Architect Vulnerability Overview Sparx Pro Cloud Server (PCS) versions <= 6.1 and Sparx Enterprise Architect (EA) versions <= 17.1 contain multiple critical security vulnerabilities. These allow remote unauthenticated attackers to execute arbitrary SQL queries (read/write) and achieve Remote Code Execution (RCE). CVSSv4 Base Score: 10.0 Critical Affected Scope Sparx Pro Cloud Server (PCS): Versions <= 6.1 build 167 Sparx Enterprise Architect (EA): Versions <= 17.1 Remediation Official Status: The vendor has not patched any CVEs. Temporary Mitigations: 1. Isolate PCS instances in untrusted networks. 2. Perform frequent backups and review access logs. 3. Configure a proxy to limit PCS authentication bypass (drop requests lacking model query parameters). --- Vulnerability Details 1. Sparx Pro Cloud Server SQL Command Execution CVE: CVE-2026-42096 CVSSv4: 9.4 Critical Description: When the client EA connects to PCS, if "Require a secure and authenticated connection" is not correctly configured, server-side authentication is omitted. Attackers can obtain the key and send custom SQL queries. PoC Code: 2. Sparx Pro Cloud Server Authentication Bypass CVE: CVE-2026-42097 CVSSv4: 9.2 Critical Description: Attackers can omit PCS authentication parameters, combined with Vulnerability #1, to achieve remote arbitrary SQL command execution. PoC Code: 3. Sparx Enterprise Architect Authorization Bypass CVE: CVE-2026-42098 CVSSv4: 7.7 High Description: By modifying binary file logic, password checks can be bypassed, allowing any user to perform arbitrary operations on models (including deletion, password theft, etc.). PoC Code: 4. Sparx Pro Cloud Server WebEA Remote Code Execution CVE: CVE-2026-42099 CVSSv4: 9.0 Critical Description:** Exploiting a race condition, attackers can execute remote unauthenticated code in the context of the web server.

Goal Reached Thanks to every supporter — we hit 100%!

Sparx EA & Pro Cloud Server Auth Bypass, RCE & SQLi Vulnerabilities