Is CVE-2026-42100 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42100 being exploited in the wild.

How severe is CVE-2026-42100?

Informational severity, with a CVSS score of 7.1, published 19 May 2026.

Which products and versions are affected?

Sparx Systems Pro Cloud Server All versions through 6.1 (build 167).

Is there a fix for CVE-2026-42100?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42100 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-42100?

Check whether you run Sparx Systems Pro Cloud Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42100: Sparx Pro Cloud Server denial of service via invalid SQL query

CVE-2026-42100 · Severity: info · CVSS 7.1 · Published 2026-05-19

Sparx Pro Cloud Server, a platform used to host and share Enterprise Architect models, is vulnerable to a denial-of-service attack. An attacker can send a specifically formatted database query that causes the server software to crash unexpectedly. This results in a service outage, preventing users from accessing or collaborating on architectural models until the service is manually restarted.

Technologies: Sparx Systems Pro Cloud Server. Vendors: Sparx Systems.

Quick answers

Is CVE-2026-42100 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42100 being exploited in the wild.
How severe is CVE-2026-42100?: Informational severity, with a CVSS score of 7.1, published 19 May 2026.
Which products and versions are affected?: Sparx Systems Pro Cloud Server All versions through 6.1 (build 167).
Is there a fix for CVE-2026-42100?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42100 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-42100?: Check whether you run Sparx Systems Pro Cloud Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Sparx Pro Cloud Server contains a vulnerability classified as Improper Handling of Syntactically Invalid Structure (CWE-228). An authenticated attacker with low privileges can execute a specially crafted SQL query that the server fails to parse or handle correctly, leading to an unhandled exception and immediate termination of the Pro Cloud Server service. The attack is carried out over the network and requires valid credentials to submit queries to the database interface. While version 6.1 (build 167) and below are confirmed vulnerable, the vendor has not provided a formal patch or confirmed the status of newer versions.

Affected products

Sparx Systems Pro Cloud Server All versions through 6.1 (build 167)

Timeline

2026-05-19: disclosed: Vulnerability disclosed by CERT Polska
2026-05-19: advisory: NVD record published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.