Sparx Systems Enterprise Architect Vulnerable to Information Disclosure via XXE
A critical vulnerability in Sparx Systems Enterprise Architect allows remote attackers to disclose sensitive information through XML External Entity (XXE) processing in its XSLT debugger.
A newly disclosed vulnerability, tracked as ZDI-26-779 and assigned CVE-2026-88794, affects Sparx Systems Enterprise Architect. This flaw resides within the software's XSLT debugger and permits remote attackers to exfiltrate sensitive information from affected systems.
The vulnerability stems from improper restrictions on XML External Entity (XXE) references. When processing a specially crafted XML document, the parser can be tricked into accessing a Uniform Resource Identifier (URI) specified within the document. The contents of this URI are then embedded back into the XML for further processing, allowing an attacker to potentially read local files or access network resources accessible by the application's process.
Exploitation of this vulnerability requires user interaction. A victim must either open a malicious file or visit a malicious web page that triggers the vulnerable component. Once initiated, the attacker can leverage the XXE flaw to disclose information within the context of the Enterprise Architect process, potentially revealing sensitive data stored or accessed by the application.
The Zero Day Initiative (ZDI) first attempted to report the vulnerability to Sparx Systems on July 24, 2026, via their web form. After receiving no response, ZDI escalated their efforts by emailing the vendor directly on July 29, 2026, seeking a secure contact for reporting. When vendor communication remained absent, ZDI reported the case to CERT.PL's coordinated disclosure program on August 6, 2026.
CERT.PL verified the reported issue and subsequently assigned a CVE identifier, CVE-2026-88794, on October 6, 2026. The coordinated public release of the advisory, detailing the zero-day vulnerability, occurred on October 16, 2026, in conjunction with ZDI and CERT.PL. The advisory was updated on the same day.
The Common Vulnerability Scoring System (CVSS) has assigned this vulnerability a score of 5.5, categorizing it as medium severity. While not critical, the potential for information disclosure remains a significant concern for organizations utilizing Sparx Systems Enterprise Architect.
Given the nature of the XXE vulnerability, the primary mitigation strategy recommended by ZDI is to restrict user interaction with the product, particularly concerning the opening of untrusted files or visiting unknown web pages. Users are advised to apply any available patches or updates from Sparx Systems as they become available.
The vulnerability was discovered and reported by Hlib Yavorskyi. The disclosure timeline highlights a significant delay in vendor response, underscoring the importance of coordinated disclosure programs and the potential risks associated with unpatched vulnerabilities.