CVE-2026-42096Disclosure(sparxsystems / pro_cloud_server)

MEDIUMCVSS 8.8 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch sparxsystems pro_cloud_server systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can run arbitrary SQL queries within database user context. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

sparxsystems CVEs Back to dashboard

5.5/ 10 priority

Sources & remediation

Exploit / PoC references

https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html

Vendor / third-party advisories

Other references

https://sparxsystems.com/products/procloudserver/

Weakness type (CWE)

CWE-863

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

pro_cloud_server

Threat summary

Active exploitation appears in 1 classified signals
Public PoC is present in monitored signal
Patch or workaround signal is available
3 mentions across 3 observed days

What's happening

Active exploitation reported across 1 signal
PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 3 signals
Disclosure: 2 classified signals
Peaked 2d ago at 1 mentions (2026-05-19); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

sparxsystems

Products

pro_cloud_server

Deep dive

Activity timeline3 mentions / 3d

Signal classification2 categories

Disclosure

266.7%

Active Exploitation

133.3%

Referenced assets2 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-19	1	Disclosure1
2026-05-21	1	Active Exploitation1
2026-06-02	1	Disclosure1

Full discourse3 posts

CCB Alert@CCBalert142d
Active Exploitation
Warning: 1 critical, 4 High, all actively exploited vulnerabilities in #Sparx Pro Cloud Server, Enterprise Architect #CVE-2026-42096 #CVE-2026-42097 #CVE-2026-42098 #CVE-2026-42099 #CVE-2026-42100 CVSS: 9.3-7.1 #PoC available #Patch #Patch #Patch
Post summary
The message warns of four high‑severity, actively exploited CVEs in Sparx Pro Cloud Server, noting that PoC code and patches are available.
01010224
7.2K followersView on X
DailyCVE@dailycve130d
Disclosure
🔴 Sparx Pro Cloud Server, Broken Access Control, #CVE-2026-42096 (Critical) -DC-Jun2026-108 https://dailycve.com/sparx-pro-cloud-server-broken-access-control-cve-2026-42096-critical-dc-jun2026-108/
Post summary
The post announces a new critical vulnerability, CVE‑2026‑42096, describing it as broken access control, but it does not provide PoC, exploit, or mitigation details.
0000034
209 followersView on X
CVE@CVEnew143d
Disclosure
CVE-2026-42096 Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can ru… https://www.cve.org/CVERecord?id=CVE-2026-42096
Post summary
The snippet announces CVE-2026-42096 as a broken access control flaw in Sparx Pro Cloud Server, but provides no PoC, exploit code, patch, or evidence of active exploitation.
00000138
57.5K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	sparxsystems	pro_cloud_server	-	-	-

Explore more

Back to dashboard sparxsystems CVEs pro_cloud_server vulnerabilities