Sparx Systems EA & Pro Cloud Server Critical Vulnerabilities: RCE, SQLi, Auth Bypass (CVE-2026-42096 to CVE-2026-42100)

Vulnerability Summary: Multiple Critical Vulnerabilities in Sparx Systems Enterprise Architect & Pro Cloud Server Vulnerability Overview Sparx Systems' Enterprise Architect (EA) and Pro Cloud Server (PCS) contain multiple critical security vulnerabilities that attackers can exploit to achieve zero-credential remote code execution, SQL injection, authentication bypass, and privilege escalation. Core Risks: Unauthorized access to enterprise architecture models, design artifacts, and user credentials without authentication Ability to execute arbitrary SQL queries and operating system commands Bypass of all access control mechanisms Potential for data breaches, complete system control, and service disruption CVSSv4 Score: 10.0 (Maximum Severity) Impact Scope Affected Products: Sparx Pro Cloud Server ≤ 6.1 build 167 Sparx Enterprise Architect ≤ 17.1 Risk Level: Critical Attack Conditions: Server is accessible from external networks (internet, VPN-less remote access) Running the affected versions mentioned above Specific Vulnerability Details CVE-2026-42096 - Access Control Bypass/Arbitrary SQL Execution (CVSSv4 8.7) Root Cause: PCS acts as a transparent database proxy using symmetric encryption keys from publicly downloadable EA trial binaries Impact: Full read access to all repository contents, unrestricted write access, credential hash collection, DBA-level SQL execution without user authorization CVE-2026-42097 - Pro Cloud Server Authentication Bypass (CVSSv4 9.3) Root Cause: SQL execution logic reads model name from URL query parameters while still providing model name in POST body Impact: SQL injection exploitation without credentials; any accessible PCS instance is vulnerable CVE-2026-42098 - Enterprise Architect Authorization Bypass (CVSSv4 8.7) Root Cause: Client-side EA binary performs authorization checks locally rather than server-side Impact: Administrator impersonation, password theft, and account takeover possible CVE-2026-42099 - WebEA Race Condition Remote Code Execution (CVSSv4 7.7) Root Cause: WebEA PHP component writes attacker-controlled file content directly to accessible directories Impact: Full remote code execution, persistent access, lateral movement within internal networks CVE-2026-42100 - PCS Endpoint Denial of Service (CVSSv4 7.1) Root Cause: Sending malformed SQL queries with unterminated escape sequences causes process crashes Impact: Any unauthorized attacker can cause complete service disruption Exploitation Chain Attackers can achieve complete control by exploiting vulnerabilities in the following sequence: 1. Authentication Bypass (CVE-2026-42097) - Bypass all server-side authentication checks 2. SQL Injection (CVE-2026-42096) - Execute arbitrary SQL using extracted encryption keys 3. Remote Code Execution (CVE-2026-42099) - Exploit race condition to execute malicious PHP files 4. Post-Exploitation - Data exfiltration, persistent access, internal infrastructure penetration Remediation Measures Immediate Actions (Within 24 Hours) Install the latest patches released by Sparx Systems Isolate PCS and WebEA from public internet access - restrict to trusted internal networks or VPN only Audit firewall and network rules to confirm no externally exposed PCS HTTP/HTTPS ports Check logs for abnormal SQL patterns and unexpected POST requests Notify security operations team and initiate incident response Short-term Measures (1-2 Weeks) Verify all PCS and EA installations are upgraded to patched versions released by Sparx Systems Enforce "Require secure and authenticated connections" in PCS configuration Disable WebEA if not required; if needed, place it behind an authenticated reverse proxy Implement network segmentation to restrict access to architecture repositories Monitor for abnormal access patterns and potential data leakage indicators Long-term Measures Implement regular security assessments and penetration testing Establish vulnerability management processes Consider alternative solutions or upgrade to unaffected product versions

Goal Reached Thanks to every supporter — we hit 100%!

Sparx Systems EA & Pro Cloud Server Critical Vulnerabilities: RCE, SQLi, Auth Bypass (CVE-2026-42096 to CVE-2026-42100)