Sparx Enterprise Architect: XML External Entity injection in XSLT Debugger
Summary
Enterprise Architect 17.1 is affected by an XML External Entity (XXE) injection in the XSLT Debugger. If a user loads a crafted XML file with a DOCTYPE that references an external DTD, the parser processes external entities, and an attacker can read arbitrary files from the victim's filesystem. Exploitation requires that the user opens the crafted file. The NVD lists CVSS 4.0 8.2 (HIGH), while ZDI lists CVSS 3.1 5.5 with a local attack vector; until this is resolved, plan with the higher score.
Affected
- Enterprise Architect 17.1 (confirmed)
- Other versions: possibly affected, not verified
Fixed in
Unknown. No vendor advisory or patched version has been published.
Workaround
- Disable the XSLT Debugger if it is not required for daily work.
- Restrict who can run Enterprise Architect and who can open model or XML files from external sources.
- Treat XML and XSLT files from unknown senders as untrusted until a patch is available.
Exploitation
- No exploitation in the wild observed; CISA SSVC lists exploitation as none and automatable as no.
- Not listed in CISA KEV.
- No public proof of concept found.
Our recommendation
- Inventory all Enterprise Architect installations, especially version 17.1.
- Apply the workarounds above until a vendor patch is available, and install the patch as soon as it is released.
- Check for and monitor vendor updates from Sparx Systems.
- Warn staff not to open XML files from untrusted sources in Enterprise Architect.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CERT Polska advisory CVE-2026-88794 cert.pl
- ZDI-26-779 advisory www.zerodayinitiative.com
- Sparx Systems Enterprise Architect product page sparxsystems.com
- OpenCVE CVE-2026-88794 app.opencve.io
- VulnHerald: Sparx Enterprise Architect XXE flaw vulnherald.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:00.
Original description (NVD)
Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 17.1 but may also affect other versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.