This vulnerability (CVE-2026-42100) in Sparx Systems Pro Cloud Server is classified under CWE-228 for improper handling of syntactically invalid structures. An attacker can send a specially crafted SQL query to the server, triggering a denial of service by causing the Pro Cloud Server service to crash. Testing confirmed that version 6.1 (build 167) and earlier are vulnerable, but the status of later versions remains unknown. The CVSS 4.0 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. The vendor has not provided a patch or detailed advisory, and no known exploits are reported in the wild.

Successful exploitation results in denial of service by terminating the Pro Cloud Server service unexpectedly, impacting availability. There is no indication of confidentiality or integrity compromise. The vulnerability affects at least version 6.1 (build 167) and earlier. The lack of vendor response and patch means affected systems remain at risk until mitigated or updated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or workaround has been published, organizations should consider restricting access to the Pro Cloud Server from untrusted networks to reduce exposure. Monitor for unusual service terminations and prepare for potential service restarts. Avoid sending malformed SQL queries to the server. Stay alert for vendor updates regarding patches or mitigations.