# CVE-2026-88794: XXE in Sparx Systems Enterprise Architect 17.1 XSLT Debugger

> CERT Polska and the CVE/NVD record describe an XML External Entity (XXE) injection (CWE-611) in the XSLT Debugger of Sparx Systems Enterprise Architect 17.1. Loading a crafted XML file with a DOCTYPE referencing an external DTD lets an attacker read arbitrary files from the victim's filesystem. No fix is available and the vendor could not be reached.

- **Published:** 2026-10-15T22:54:28Z
- **Last reviewed:** 2026-10-15T22:54:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3674
- **ID:** TL-2026-3674
- **Severity:** HIGH (CVSS 8.2)
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 8 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-88794

## Description

Enterprise Architect, the UML/modeling suite from Sparx Systems, contains an XML External Entity (XXE) injection weakness (CWE-611) in its XSLT Debugger feature. When a user loads a crafted XML file containing a DOCTYPE declaration with an external Document Type Definition (DTD) reference, the XML parser resolves external entities, allowing an attacker to read arbitrary files from the victim's filesystem.

The issue was reported by Hlib Yavorskyi working with the TrendAI Zero Day Initiative and coordinated by CERT Polska, which published the advisory on 2026-10-15 together with the CVE record. Version 17.1 is confirmed vulnerable; other versions may be affected but are unconfirmed. CERT Polska states that attempts to contact the vendor were unsuccessful, and no fix or vendor mitigation is documented.

The CVE record carries a CVSS v4.0 base score of 8.2 (HIGH) with vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N: exploitation requires user interaction (opening the crafted file in the XSLT Debugger) and impacts confidentiality only. The sources report no public proof-of-concept, no confirmed in-the-wild exploitation, no associated threat actor and no network IOCs. The means of delivering the crafted file to a victim are not described in the sources; file-based delivery (for example via email or shared repositories) is an analyst inference. Whether the external DTD is fetched from an attacker-controlled host, enabling out-of-band retrieval of file contents, is likewise not stated in the sources and is the standard XXE pattern rather than a documented behavior of this flaw.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1203 Exploitation for Client Execution
- T1005 Data from Local System

## Sources

- [Vulnerability in Sparx Systems Enterprise Architect software (CVE-2026-88794)](https://cert.pl/en/posts/2026/10/CVE-2026-88794/)
- [NVD - CVE-2026-88794](https://nvd.nist.gov/vuln/detail/CVE-2026-88794)
- [CVE Record - CVE-2026-88794](https://www.cve.org/CVERecord?id=CVE-2026-88794)
- [Sparx Systems - Enterprise Architect product page](https://sparxsystems.com/products/ea/)
- [CWE-611: Improper Restriction of XML External Entity Reference](https://cwe.mitre.org/data/definitions/611.html)
- [CERT Polska - Coordinated Vulnerability Disclosure](https://cert.pl/en/cvd/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3674