--- schema: 1 kind: threat title: "Sparx Enterprise Architect / Pro Cloud Server — five-CVE chain (pre-auth SQL injection + WebEA race-condition RCE), public PoC, no vendor patch" headline: "Sparx Enterprise Architect / Pro Cloud Server — five-CVE chain (pre-auth SQL injection + WebEA race-condition RCE), public PoC, no vendor patch" summary: "Sparx Enterprise Architect + Pro Cloud Server: five-CVE chain reaching CVSSv4 10.0; public PoC; no vendor patch. CERT Polska coordinated disclosure 2026-05-19 (CVE-2026-42096 / 42097 / 42098 / 42099 / 42100). Pre-auth SQL injection (42097) + WebEA race-condition RCE (42099) on PCS ≤6.1 chains to unauthenticated code execution (CERT Polska, 2026-05-19 · sploit.tech, 2026-05-19). Sparx EA is widely deployed in EU/CH government enterprise-architecture units." discovered_at: "2026-05-20T05:00:02Z" event_date: 2026-05-19 run_id: 2026-05-20-a0f7b07f priority: high immediate_action: null tags: - vulnerabilities - pre-auth - rce - auth-bypass - poc-public - no-patch regions: - switzerland - europe - global sectors: - public-sector - education - technology entities: - "trend:sparx-enterprise-architect-pro-cloud-server-five-cve-chain-c" cves: - id: CVE-2026-42096 cvss: n/a epss: null type: rce vector: user-interaction auth: pre-auth status: - poc-public - no-patch - id: CVE-2026-42097 cvss: "9.3" epss: null type: rce vector: user-interaction auth: pre-auth status: - poc-public - no-patch - id: CVE-2026-42098 cvss: "8.7" epss: null type: rce vector: user-interaction auth: pre-auth status: - poc-public - no-patch - id: CVE-2026-42099 cvss: "7.7" epss: null type: rce vector: user-interaction auth: pre-auth status: - poc-public - no-patch - id: CVE-2026-42100 cvss: n/a epss: null type: rce vector: user-interaction auth: pre-auth status: - poc-public - no-patch sources: - url: "https://cert.pl/en/posts/2026/05/CVE-2026-42096/" publisher: "CERT Polska CVE-2026-42096, 2026-05-19" role: primary - url: "https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html" publisher: "sploit.tech researcher write-up, 2026-05-19" role: corroborating - url: "https://euvd.enisa.europa.eu/enisa/eu_vulnerability_database/EUVD-2026-30931" publisher: ENISA EUVD-2026-30931 role: corroborating closed_sources: [] evidence: [] verification: multi-source sourcing_note: null confidence: high update_of: null references: [] deep_dive: false deep_dive_category: null org_triage: null watchlist_hit: false actions: - "**Sparx PCS / WebEA — restrict to internal networks until vendor patch ships.** Block management-plane reachability from any non-management network at the perimeter; disable WebEA where it's not required; monitor IIS / Apache for POSTs to `/data_api/dl_internal_artifact.php` and for `_api/data` requests omitting `model` query param; rotate every database credential reachable from PCS. Public PoC available ([CERT Polska CVE-2026-42096](https://cert.pl/en/posts/2026/05/CVE-2026-42096/))." migrated_from: briefs/2026-05-20.md --- CERT Polska coordinated disclosure of five Sparx Systems vulnerabilities on [2026-05-19](https://cert.pl/en/posts/2026/05/CVE-2026-42096/), each separately filed in [ENISA EUVD-2026-30929 through EUVD-2026-30932](https://euvd.enisa.europa.eu/enisa/eu_vulnerability_database/EUVD-2026-30931). Researcher [Blazej Adamczyk (br0x) published the full technical write-up](https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html) with proof-of-concept code; the chained CVSSv4 score on Pro Cloud Server (PCS) ≤6.1 with the optional WebEA component installed is **10.0 Critical**. - **CVE-2026-42097** (CWE-639, CVSS4 9.3) — Authentication bypass in PCS via model-parameter omission in a POST binary blob. The URL query parameter `model` is checked at the auth gate; the model name resent only inside the binary blob bypasses it, enabling unauthenticated arbitrary SQL query execution (read + write) against any configured repository database. - **CVE-2026-42096** (CWE-863) — Authenticated SQL injection in an exposed database API endpoint; any authenticated user can inject arbitrary SQL. - **CVE-2026-42099** (CWE-362, CVSS4 7.7) — Race condition in `/data_api/dl_internal_artifact.php`. An attacker who can stage a repository file controls both filename and contents written to `__DIR__`; a slow-client timing attack keeps the PHP file live during transmission so a parallel HTTP request executes it — RCE in the web-server context. Requires the WebEA component. - **CVE-2026-42098** (CWE-603, CVSS4 8.7) — Client-side authentication in Enterprise Architect ≤17.1: RBAC is enforced in the client binary, so any authenticated user who patches the binary can log in as any other user (including administrator) and perform arbitrary repository modifications. - **CVE-2026-42100** (CWE-835) — Malformed SQL crashes the Pro Cloud Server service (DoS). Sparx Systems was notified in advance but did not respond with version specifics or a remediation timeline; **no official patch has been released**. Tested vulnerable versions: PCS ≤6.1 build 167 and EA ≤17.1. Public exploit code is published in [br0xpl/sparx_hack](https://github.com/br0xpl/sparx_hack/). CERT-PL emphasises that the vendor "didn't respond with the details of vulnerability or vulnerable version range" ([CERT Polska](https://cert.pl/en/posts/2026/05/CVE-2026-42096/)). **Why it matters to us:** Sparx Enterprise Architect is one of the dominant tools for IT enterprise-architecture modelling across EU and Swiss federal / cantonal IT units; Pro Cloud Server exposes EA repositories to remote teams over HTTP. Until a patch ships, restrict PCS / WebEA reachability to internal management networks only, disable WebEA if not strictly required, monitor IIS / Apache access logs for `/data_api/dl_internal_artifact.php` requests with unusual `guid` parameters and for any `_api/data` POST that omits the `model` query parameter, and rotate every database credential reachable from the PCS service account.