EUVD-2026-30932
GHSA-r2pf-hp27-79jw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Pro Cloud Server
-
DeliveryAuthenticate with low-privileged account
-
ExploitSend syntactically invalid SQL query
-
ExecutionTrigger unhandled parser exception
-
PersistPro Cloud Server process terminates
-
ImpactModeling clients lose repository access
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V1 - Encoding and Sanitization Parameter handling
|
| Exploitation Conditions | Exploitation requires network reachability to the Sparx Pro Cloud Server listener and a valid low-privileged authenticated session (CVSS PR:L), so anonymous internet attackers cannot trigger it directly; no user interaction is needed (UI:N) and attack complexity is low (AC:L). The specific prerequisite is the ability to submit a syntactically invalid SQL query through the Pro Cloud Server's query interface - the same channel used by Enterprise Architect clients for repository access. Confirmed exploitation is limited to Pro Cloud Server version 6.1 (build 167) and earlier on Sparx-supported platforms; later builds were not tested by the researcher and the vendor did not confirm whether they are affected, so risk on newer versions is unverified rather than ruled out. Impact is limited to availability - the service crashes but no data is read or modified - and recovery requires a service restart. |
| Impact | The CVSS:4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H scores 7.1 and reflects a network-reachable, low-complexity attack requiring low privileges, with impact confined to availability (VA:H) and no confidentiality or integrity loss. The vulnerability is not listed in CISA KEV and no public exploit identified at time of analysis, and no EPSS score was supplied with the input. Realistically this is a targeted availability issue rather than a critical priority: it requires an authenticated session against the Pro Cloud Server, and the only consequence is a service crash that can typically be recovered by restarting the daemon. The biggest open question is the version range - the vendor declined to confirm which builds beyond 6.1 (build 167) are affected, so defenders cannot rule out exposure on newer builds without independent testing. |
| Exploit ScenarioDerived | An attacker with a low-privileged account on the Pro Cloud Server - for example, a contractor modeler or a compromised user credential - connects to the repository service over the network and submits a specially crafted, syntactically invalid SQL query. The server's parser fails to handle the malformed structure, raises an unhandled exception, and the Pro Cloud Server process terminates, disconnecting every Enterprise Architect client and stalling collaborative modeling work until the service is restarted; the issue can be repeated to sustain an outage. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 19, 2026
Denial of service in Sparx Systems Pro Cloud Server 6.1 (build 167) and earlier allows authenticated remote attackers to crash the service by submitting a specially crafted SQL query that the server fails to parse safely. The flaw, reported by CERT-PL, results in unexpected termination of the Pro Cloud Server process, and no public exploit identified at time of analysis. The vendor did not respond to disclosure, so the full vulnerable version range remains unconfirmed.
RemediationAI
No vendor-released patch identified at time of analysis, as Sparx Systems did not respond to CERT-PL's disclosure with fix or version information; administrators should monitor https://sparxsystems.com/products/procloudserver/ and the CERT-PL advisory at https://cert.pl/en/posts/2026/05/CVE-2026-42096 for an updated build and contact Sparx support directly to confirm whether builds above 6.1 (build 167) include a fix. As compensating controls, restrict network reachability of the Pro Cloud Server listener to trusted modeler subnets via firewall ACLs or VPN-only access (trade-off: blocks legitimate remote modelers and integration clients), tighten authentication and remove low-privilege accounts that are not strictly required for repository access (trade-off: reduces who can collaborate), enable process supervision or a watchdog to automatically restart the service after termination to limit downtime (trade-off: does not prevent repeated crashes), and increase logging/alerting on Pro Cloud Server crashes and malformed-query errors so abuse is detected quickly. Additional technical detail and PoC context can be cross-checked at https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html and https://efigo.pl/blog/CVE-2026-42096/.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pro Cloud Server is the back-end service from Sparx Systems that brokers model repository access for Enterprise Architect clients, exposing SQL-style query interfaces over the network for collaborative modeling, version control, and integration with external data stores. The root cause is classified as CWE-228 (Improper Handling of Syntactically Invalid Structure): the server's query parser does not gracefully reject malformed SQL, instead propagating the parsing error into an unhandled exception path that terminates the service process. The CPE cpe:2.3:a:sparx_systems:pro_cloud_server:*:*:*:*:*:*:*:* covers all builds of the product, while EUVD-2026-30932 narrows confirmed exposure to versions up to and including 6.1.
Know when Pro Cloud Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server allows Denial of Service (DoS) attack to be executed by sending an specially crafted SQL query. This causes the Pro Cloud Server service to terminate unexpectedly.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Executive ViewAI
Sparx Systems Pro Cloud Server 6.1 and earlier contains a denial-of-service vulnerability that allows authenticated users to crash the service through malicious SQL queries, disrupting availability for organizations dependent on this platform. Since the vendor has not released a patch, organizations using affected versions face ongoing risk of service interruptions until alternative mitigations are in place.
Restrict network access to trusted internal networks or specific IP ranges; implement process restart automation to minimize downtime from crashes; enable detailed SQL query and error logging to detect exploitation attempts; enforce database-level access controls limiting which users can submit arbitrary SQL; monitor process health and implement alerting on unexpected terminations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
More in Pro Cloud Server
View allUnauthenticated SQL execution affects Sparx Pro Cloud Server when attackers omit the 'model' query parameter from the UR
Broken access control in Sparx Systems Pro Cloud Server 6.1 (build 167) and earlier allows authenticated low-privileged
Remote code execution in Sparx Systems Pro Cloud Server (versions 0 through 6.1 build 167) is achievable by authenticate
Exploit-DB