Is CVE-2026-88794 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-88794 being exploited in the wild.

How severe is CVE-2026-88794?

Informational severity, published 15 October 2026.

Which products and versions are affected?

Sparx Systems Enterprise Architect 17.1 confirmed; other versions may be affected.

Is there a fix for CVE-2026-88794?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-88794 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2026-88794?

Check whether you run Sparx Systems Enterprise Architect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-88794: Sparx Systems Enterprise Architect XXE injection in XSLT Debugger

CVE-2026-88794 · Severity: info · Published 2026-10-15

Sparx Systems Enterprise Architect is a software modeling and design tool used by enterprises to create technical diagrams and system architecture documentation. The XSLT Debugger feature fails to restrict XML external entity processing, allowing an attacker to craft a malicious XML file that, when opened by a user, reads sensitive files from the victim's computer. This can lead to exposure of configuration files, source code, credentials, or other confidential data stored on the affected system.

Vendors: Sparx Systems.

Quick answers

Is CVE-2026-88794 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-88794 being exploited in the wild.
How severe is CVE-2026-88794?: Informational severity, published 15 October 2026.
Which products and versions are affected?: Sparx Systems Enterprise Architect 17.1 confirmed; other versions may be affected.
Is there a fix for CVE-2026-88794?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-88794 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2026-88794?: Check whether you run Sparx Systems Enterprise Architect at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an XML External Entity (XXE) injection flaw in the XSLT Debugger component. When a user loads a crafted XML file containing a DOCTYPE with an external DTD reference, the XML parser processes external entities without proper restrictions, enabling arbitrary file read on the local filesystem. The attack requires user interaction (opening a malicious XML file) and is triggered via the Debugger feature; no network access to the target is required.

Affected products

Sparx Systems Enterprise Architect 17.1 confirmed; other versions may be affected

Timeline

2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.