CVE-2026-42098

HIGH EPSS 32.0%
Published May 19, 20261mo ago · Modified Jun 17, 20262w ago
8.7 CVSS 4.0
High
Find Similar
Published May 19, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago

Description

Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect client behavior (e.g. using a debugger) and log in as any other user or administrator - then it is possible to do every possible change to the repository. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 17.1 and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.

CVSS Details

Base Score
8.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
32.0% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-603

References 4

  • cert.pl https://cert.pl/en/posts/2026/05/CVE-2026-42096
  • efigo.pl https://efigo.pl/blog/CVE-2026-42096/
  • sparxsystems.com https://sparxsystems.com/products/ea/
  • sploit.tech https://sploit.tech/2026/05/19/Sparx-Enterprise-Architect-PCS.html

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.