CVE-2026-42097
CWE-639Published: May 19, 2026· Updated: May 19, 2026
Official Description
Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "model" query parameter and send the model name only in the binary blob in POST request allowing SQL query execution without authentication.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Risk Analysis
This critical vulnerability in Sparx Pro Cloud Server allows for SQL query execution without authentication due to improper authentication based on requested URL. With a CVSS score of 9.3, this flaw poses a high risk, as it could lead to unauthorized access and manipulation of database information. The EPSS score is currently unavailable, so the likelihood of exploitation is unknown.
No public exploit is currently known for this vulnerability. Its network attack vector and low attack complexity indicate it is remotely exploitable without user interaction.
To address this vulnerability, ensure all requests to Sparx Pro Cloud Server are properly authenticated, especially those involving model names in binary blobs. Implement strict input validation and access controls to prevent unauthorized SQL query execution.
Technical Analysis
CVE-2026-42097 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.
The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.
CVSS v3.1 Vector Breakdown
Exploit & PoC Resources
All References (4)
Quick Facts
Related CVEs (CWE-639)
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2026-42097 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts