ZDI-26-779: (0Day) Sparx Systems Enterprise Architect XSLT Debugger XML External Entity Processing Information Disclosure Vulnerability
Unpatched ZDI zero-day lets remote attackers leak data from Sparx Enterprise Architect via XXE with user interaction.
ZDI-26-779 describes an unpatched XML external entity flaw in the XSLT Debugger of Sparx Systems Enterprise Architect. A remote attacker can disclose sensitive information if a user opens a malicious file or visits a malicious page. ZDI assigned CVSS 5.5 and CVE-2026-88794 and labeled the issue a zero-day. The advisory does not state that exploitation has been observed.
- Unpatched XXE in Enterprise Architect XSLT Debugger
- Remote information disclosure requires user interaction
- CVSS 5.5, tracked as CVE-2026-88794
- ZDI labels it a zero-day; exploitation not reported
- CVEs
- CVE-2026-88794
- Vendors
- Sparx Systems
- Products
- Enterprise Architect
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-88794 | XXE in Enterprise Architect XSLT Debugger | 8.2 | — |
From the original article
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Sparx Systems Enterprise Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 5.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.