Threat reportVulnerabilityTL-2026-3674
CVE-2026-88794: XXE in Sparx Systems Enterprise Architect 17.1 XSLT Debugger
CVE-2026-88794 (TL-2026-3674) is a high-severity software vulnerability scored CVSS 8.2, first published 2026-10-15. It has no confirmed attribution, affects Sparx Systems Enterprise Architect (XSLT Debugger), references 1 CVE (CVE-2026-88794), maps to 4 MITRE ATT&CK techniques (T1005, T1203, T1204.002), and is covered by 9 detection rules and 8 indicators of compromise.
- CVSS
- 8.2/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 8Indicators of compromise
Key facts for TL-2026-3674
- Threat ID
- TL-2026-3674
- Severity
- HIGH
- CVSS
- 8.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N)
- Status
- TRACKING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, enterprise-architecture
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 8
Malware and tooling in CVE-2026-88794
Malware and tooling: Enterprise Architect XSLT Debugger
How CVE-2026-88794 works
CERT Polska and the CVE/NVD record describe an XML External Entity (XXE) injection (CWE-611) in the XSLT Debugger of Sparx Systems Enterprise Architect 17.1. Loading a crafted XML file with a DOCTYPE referencing an external DTD lets an attacker read arbitrary files from the victim's filesystem. No fix is available and the vendor could not be reached.
Enterprise Architect, the UML/modeling suite from Sparx Systems, contains an XML External Entity (XXE) injection weakness (CWE-611) in its XSLT Debugger feature. When a user loads a crafted XML file containing a DOCTYPE declaration with an external Document Type Definition (DTD) reference, the XML parser resolves external entities, allowing an attacker to read arbitrary files from the victim's filesystem.
The issue was reported by Hlib Yavorskyi working with the TrendAI Zero Day Initiative and coordinated by CERT Polska, which published the advisory on 2026-10-15 together with the CVE record. Version 17.1 is confirmed vulnerable; other versions may be affected but are unconfirmed. CERT Polska states that attempts to contact the vendor were unsuccessful, and no fix or vendor mitigation is documented.
The CVE record carries a CVSS v4.0 base score of 8.2 (HIGH) with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N: exploitation requires user interaction (opening the crafted file in the XSLT Debugger) and impacts confidentiality only. The sources report no public proof-of-concept, no confirmed in-the-wild exploitation, no associated threat actor and no network IOCs. The means of delivering the crafted file to a victim are not described in the sources; file-based delivery (for example via email or shared repositories) is an analyst inference. Whether the external DTD is fetched from an attacker-controlled host, enabling out-of-band retrieval of file contents, is likewise not stated in the sources and is the standard XXE pattern rather than a documented behavior of this flaw.
MITRE ATT&CK techniques used in TL-2026-3674
Collection
Execution
T1203 Exploitation for Client Execution; T1204.002 Malicious File
Initial Access
Affected products and versions in CVE-2026-88794
- Sparx Systems — Enterprise Architect (XSLT Debugger)
Vulnerable versions: 17.1
Remediation for CVE-2026-88794
Immediate actions
- Do not load XML/XSLT files from untrusted or unverified sources in the Enterprise Architect XSLT Debugger
- Restrict outbound HTTP/HTTPS from workstations running Enterprise Architect to reduce the reach of external DTD resolution
Workarounds
- Avoid using the XSLT Debugger feature on files of untrusted origin until a fix is published
Longer-term hardening
- Monitor the Sparx Systems product page and CERT Polska advisory for a vendor fix
- Inventory Enterprise Architect installations and versions across the environment
CVEs associated with CVE-2026-88794
Weaknesses (CWE) in CVE-2026-88794
Timeline of CVE-2026-88794
- Affected-version scope limited to 17.1 because vendor coordination failed; other Enterprise Architect versions may be affected but remain unverified
- At publication the sources report no public proof-of-concept, no confirmed in-the-wild exploitation, no associated threat actor and no network IOCs
- NVD entry for CVE-2026-88794 lists the CERT Polska advisory and the Sparx Systems product page as references, with CWE-611 and CVSS v4.0 8.2 (HIGH)
- Vulnerability credited to Hlib Yavorskyi, working with the TrendAI Zero Day Initiative; version 17.1 confirmed affected, other versions unconfirmed
- Advisory states attempts to contact Sparx Systems were unsuccessful; no vendor fix or mitigation is available at publication
- CVE record lists a CVSS v4.0 base score of 8.2 (HIGH), vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
- CVE-2026-88794 record published, referencing the CERT Polska advisory and the Sparx Systems product page
- CERT Polska publishes advisory for CVE-2026-88794, an XXE (CWE-611) in the XSLT Debugger of Sparx Systems Enterprise Architect 17.1
Sources cited for CVE-2026-88794
Detection coverage for TL-2026-3674
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3674 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.