CVE-2026-42100

Vulnerability

Improper handling of syntactically invalid structure in Sparx Pro Cloud Server (versions up to 6.1 build 167) allows a remote attacker to send a specially crafted SQL query that causes the Pro Cloud Server service to terminate unexpectedly [1] [2].

Exploitation

An attacker with network access to the Pro Cloud Server can send a specially crafted SQL query. No authentication is required if the SQL endpoint is exposed. The attack does not require user interaction and can be executed remotely [1] [2].

Impact

Successful exploitation leads to a denial of service (DoS) condition where the Pro Cloud Server service terminates abruptly, rendering the server unavailable until manually restarted. No data corruption, disclosure, or privilege escalation is indicated [1] [2].

Mitigation

No official fix has been released. The vendor was notified but did not provide details of the vulnerability or a patched version range. Only version 6.1 (build 167) and below were tested and confirmed vulnerable; other versions may also be affected. As a workaround, restrict network access to the Pro Cloud Server and implement input validation or firewall rules to filter malformed SQL queries at the network perimeter [1] [2].