Is CVE-2026-42097 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42097 being exploited in the wild.

How severe is CVE-2026-42097?

Informational severity, with a CVSS score of 9.3, published 19 May 2026.

Which products and versions are affected?

Sparx Systems Pro Cloud Server All versions through 6.1 (build 167).

Is there a fix for CVE-2026-42097?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42097 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-42097?

Check whether you run Sparx Systems Pro Cloud Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42097: Sparx Systems Pro Cloud Server authentication bypass via model parameter omission

CVE-2026-42097 · Severity: info · CVSS 9.3 · Published 2026-05-19

Sparx Pro Cloud Server, a platform used to host and share Enterprise Architect models, contains a security flaw that allows unauthorized users to bypass authentication. By manipulating how the server identifies the target database model in a web request, an attacker can gain the ability to run arbitrary database commands. This could lead to the theft of sensitive architectural designs, unauthorized modification of project data, or full compromise of the underlying database.

Technologies: Sparx Systems Pro Cloud Server. Vendors: Sparx Systems.

Quick answers

Is CVE-2026-42097 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42097 being exploited in the wild.
How severe is CVE-2026-42097?: Informational severity, with a CVSS score of 9.3, published 19 May 2026.
Which products and versions are affected?: Sparx Systems Pro Cloud Server All versions through 6.1 (build 167).
Is there a fix for CVE-2026-42097?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42097 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-42097?: Check whether you run Sparx Systems Pro Cloud Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Sparx Pro Cloud Server (PCS) exhibits an authorization bypass (CWE-639) due to inconsistent authentication checks based on the requested URL structure. The application typically requires authentication based on the 'model' query parameter; however, an attacker can omit this parameter from the URL and instead include the model name within the binary blob of a POST request. This bypasses the server's authentication gate while still allowing the request to be processed against the target model. Consequently, a remote, unauthenticated attacker can execute arbitrary SQL queries within the context of the database user, leading to full data exfiltration or modification. The vulnerability was confirmed in version 6.1 (build 167) and earlier.

Affected products

Sparx Systems Pro Cloud Server All versions through 6.1 (build 167)

Timeline

2026-05-19: disclosed: Vulnerability disclosed by CERT Polska and sploit.tech
2026-05-19: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.