CVE-2026-88794: Unpatched XXE Flaw in Sparx Systems Enterprise Architect — Detection and Mitigation Guide

The Zero Day Initiative has published ZDI-26-779, disclosing an unpatched XML External Entity (XXE) processing vulnerability in Sparx Systems Enterprise Architect, tracked as CVE-2026-88794 with a CVSS score of 5.5 (Medium). The flaw lives in the product's XSLT Debugger component and allows remote attackers to disclose sensitive information from affected installations — provided they can convince a user to open a malicious file or visit a malicious page.

This is a zero-day: ZDI's publication means coordinated disclosure timelines have elapsed and no vendor patch is currently available. Enterprise Architect is ubiquitous in organizations that do UML modeling, systems architecture, and — critically — XSLT transformation work in finance, government, defense, and engineering sectors. That user base routinely handles sensitive design documents, network diagrams, and data transformation logic. An XXE flaw in this toolchain is a direct pipeline for file theft: think C:\Windows\win.ini in the textbook case, but in real engagements we see attackers pull SSH keys, configuration files, .git credentials, and internal wiki exports.

CVSS 5.5 undersells the practical risk. Yes, user interaction is required, and yes, the impact is confidentiality-only. But XXE is a quiet, low-friction exfiltration primitive that blends into normal document workflows — exactly the kind of bug that shows up in targeted phishing against architects and developers. Treat this as actionable now, not when the patch drops.

Technical Analysis

Affected Product

• Product: Sparx Systems Enterprise Architect (Windows desktop application)
• Component: XSLT Debugger / XSLT transformation engine
• Advisory: ZDI-26-779 — http://www.zerodayinitiative.com/advisories/ZDI-26-779/
• CVE: CVE-2026-88794
• CVSS: 5.5 (Medium) — vector consistent with local parse context, user interaction required, high confidentiality impact
• Patch status: Unpatched at time of publication (0-day)

How the Vulnerability Works

The root cause is classic: the XML parser underpinning Enterprise Architect's XSLT Debugger processes external entity declarations in a crafted XML/XSLT document without restricting external resource resolution. When a user opens a malicious .xml or .xsl file (or triggers a transformation/debug session against one), the parser dereferences attacker-controlled SYSTEM entity URIs.

A typical malicious payload embedded in an XSLT stylesheet looks conceptually like:

<!DOCTYPE xsl:stylesheet [
  <!ENTITY xxe SYSTEM "file:///C:/Users/victim/.ssh/id_rsa">
]>

From a defender's perspective, the exploitation chain is:

1. Delivery: Attacker sends a weaponized .xml, .xsl, or .xslt file (phishing attachment, shared repository, poisoned project template) or lures the target to a malicious page hosting the document.
2. Trigger: Target opens the file in Enterprise Architect and engages the XSLT Debugger/transformation feature.
3. Entity resolution: The XML parser resolves external entities — reading local files (file://) and/or making outbound connections to attacker infrastructure (http://, sometimes ftp:// or UNC paths for NTLM credential capture via \\attacker\share).
4. Exfiltration: File contents are reflected back through the transformation output, error channel, or an outbound HTTP request carrying the data in a parameter — classic out-of-band (OOB) XXE.

Two secondary impacts worth flagging for your risk assessment:

• NTLM hash capture: On Windows, file:// entities pointing to UNC paths (\\evil-host\share) force the EA process to authenticate outbound via SMB, leaking NTLMv2 hashes that can be relayed or cracked offline. This converts a 'Medium' info-leak into a credential-theft primitive.
• SSRF-adjacent behavior: Entities can hit internal URLs, giving attackers a crude internal port/service probe from the victim workstation.

Exploitation Status

• In-the-wild exploitation: Not confirmed as of publication.
• Public PoC: ZDI advisories of this class typically include sufficient technical detail for a skilled researcher to reconstruct a trigger; assume working PoCs exist in private hands.
• CISA KEV: Not listed at time of writing — monitor for addition.
• Vendor patch: None. Sparx Systems has not released a fix; ZDI published after its standard disclosure window.

Until a patch ships, detection and compensating controls are your entire defense. The good news: XXE in a desktop application produces a distinctive, high-signal telemetry pattern — a modeling tool that suddenly starts making outbound network connections is anomalous almost everywhere.

Detection & Response

The core detection thesis: Enterprise Architect (EA.exe) is a desktop modeling tool. In the overwhelming majority of environments it has zero legitimate reason to initiate outbound network connections to the internet, to UNC shares, or to internal HTTP services during XSLT processing. Entity resolution by the embedded XML parser is observable as network connections (and, for UNC-based hash theft, outbound SMB) originating from EA.exe. Hunt on that.

SIGMA Rules

---
title: Sparx Enterprise Architect Outbound Network Connection - Possible XXE Entity Resolution
id: 3f8a2b41-9c1e-4d7a-b5f2-8e6c1a4d9027
status: experimental
description: Detects the Enterprise Architect process (EA.exe) initiating outbound network connections, consistent with XML External Entity (XXE) resolution triggered by a malicious XSLT/XML document (CVE-2026-88794 / ZDI-26-779). Legitimate EA usage is overwhelmingly offline.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-779/
  - https://attack.mitre.org/techniques/T1203/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.exfiltration
  - attack.t1203
  - attack.t1041
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\EA.exe'
      - '\EAx86.exe'
  filter_local:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '127.'
      - '169.254.'
      - 'fe80:'
  condition: selection_image and not filter_local
falsepositives:
  - EA license server checks or update mechanisms in some deployments - baseline and allowlist your own update endpoints
level: high
---
title: Enterprise Architect Outbound SMB - Possible XXE NTLM Hash Capture
id: 7c1d5e92-4a38-4f6b-91cd-2b8e3f07a651
status: experimental
description: Detects EA.exe establishing outbound SMB (TCP/445) connections to non-RFC1918 destinations, indicating UNC-path external entity resolution used to capture NTLMv2 hashes via a malicious XML/XSLT document (CVE-2026-88794).
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-779/
  - https://attack.mitre.org/techniques/T1187/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.credential_access
  - attack.t1187
  - attack.exfiltration
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith:
      - '\EA.exe'
      - '\EAx86.exe'
    DestinationPort: 445
  filter_local:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
      - '127.'
  condition: selection and not filter_local
falsepositives:
  - Rare - EA has no legitimate reason to open internet-facing SMB sessions
level: critical
---
title: Enterprise Architect Spawning Child Processes - Post-Exploitation Follow-On
id: b24e6f08-1d93-4c58-a7e2-6f1c9d3b8472
status: experimental
description: Detects EA.exe spawning scripting interpreters, shells, or system utilities. While CVE-2026-88794 is information disclosure, any child process execution under a document-driven application warrants immediate triage as follow-on activity or chained exploitation.
references:
  - http://www.zerodayinitiative.com/advisories/ZDI-26-779/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\EA.exe'
      - '\EAx86.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
      - '\curl.exe'
      - '\wget.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Extremely rare - EA does not spawn scripting engines in normal modeling/XSLT workflows
level: high

KQL — Microsoft Sentinel / Defender

Hunt for EA-initiated outbound connections over the past 14 days. This catches both direct OOB exfiltration (HTTP) and NTLM capture attempts (SMB). Enrichment with process command lines helps you identify which document was open.

// Hunt: Enterprise Architect outbound network activity - possible XXE (CVE-2026-88794)
let Lookback = 14d;
DeviceNetworkEvents
| where TimeGenerated >= Lookback
| where InitiatingProcessFileName has_any ("EA.exe", "EAx86.exe")
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168."
  and RemoteIP !startswith "172.16." and RemoteIP !startswith "127."
  and RemoteIP !startswith "169.254."
| project TimeGenerated, DeviceName, InitiatingProcessAccountName,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          RemoteIP, RemotePort, RemoteUrl, ActionType
| sort by TimeGenerated desc;
// Correlate: XSLT/XML files opened shortly before suspicious connections
DeviceFileEvents
| where TimeGenerated >= Lookback
| where FileName endswith ".xsl" or FileName endswith ".xslt" or FileName endswith ".xml"
| where InitiatingProcessFileName has_any ("EA.exe", "EAx86.exe")
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessAccountName
| sort by TimeGenerated desc;

If you ingest Sysmon via Sentinel, mirror the logic against Event (Event ID 3) filtering Image endswith 'EA.exe'. Note that the first rule's allowlist of internal ranges is a starting point — an attacker on your LAN or a malicious internal host makes internal XXE callbacks possible, so tier-2 analysts should also review new internal destinations for EA.exe, especially port 445 and 80/443 to hosts EA has never touched before.

Velociraptor VQL

Deploy this as a hunt across endpoints where Enterprise Architect is installed. It enumerates live connections from EA processes and lists recently modified XSLT/XML files in user-accessible locations — giving you both sides of the kill chain in one collection.

-- Hunt: EA.exe network connections + recent XSLT/XML artifacts (CVE-2026-88794)
-- Part 1: Live network connections owned by Enterprise Architect
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Name =~ '(?i)EA(x86)?\\.exe'

-- Part 2: Recently created/modified XSLT stylesheets in user profile locations
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:/Users/*/Downloads/*.xsl*',
          accessor='file')
WHERE Mtime > now() - 1209600

Extend the glob list with C:/Users/*/**.xsl* scoped to Desktop/Documents if your users store transformation projects there, and consider pairing with a parse_xml-style artifact if you want to sweep downloaded .xsl files for <!ENTITY declarations with SYSTEM URIs — that content check is the highest-fidelity pre-execution tripwire available while the bug is unpatched.

Remediation / Hardening Script

Since no patch exists, this PowerShell script does three things: (1) inventories installed Enterprise Architect versions, (2) applies egress firewall rules blocking EA.exe from initiating outbound connections (the single most effective compensating control against XXE exfiltration and NTLM capture), and (3) enables an audit posture so you can verify rule hits. Run elevated. Test in a pilot OU first — if your organization uses EA's floating license or cloud integration features, allowlist those specific endpoints before enforcing.

# CVE-2026-88794 compensating controls - Sparx Enterprise Architect XXE
# Run as Administrator. Test before broad deployment.

# 1. Inventory Enterprise Architect installations
$eaPaths = @(
    "$env:ProgramFiles\Sparx Systems\EA\EA.exe",
    "${env:ProgramFiles(x86)}\Sparx Systems\EA\EA.exe"
)
foreach ($p in $eaPaths) {
    if (Test-Path $p) {
        $v = (Get-Item $p).VersionInfo
        Write-Host "[+] Found: $p | Version: $($v.ProductVersion)" -ForegroundColor Cyan
    }
}
$uninst = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
                          "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" -ErrorAction SilentlyContinue |
          Where-Object { $_.DisplayName -like "*Enterprise Architect*" }
$uninst | Select-Object DisplayName, DisplayVersion | Format-Table -AutoSize

# 2. Block outbound connections from EA.exe (XXE exfil + NTLM capture mitigation)
foreach ($p in $eaPaths) {
    if (Test-Path $p) {
        $ruleName = "Block EA.exe Outbound - CVE-2026-88794 ($(Split-Path $p -Leaf))"
        if (-not (Get-NetFirewallRule -DisplayName $ruleName -ErrorAction SilentlyContinue)) {
            New-NetFirewallRule -DisplayName $ruleName `
                -Direction Outbound -Program $p -Action Block `
                -Profile Any -Enabled True | Out-Null
            Write-Host "[+] Firewall rule created: $ruleName" -ForegroundColor Green
        } else {
            Write-Host "[=] Rule already exists: $ruleName" -ForegroundColor Yellow
        }
    }
}

# 3. Explicitly block outbound SMB (TCP 445) from EA.exe as a belt-and-braces layer
foreach ($p in $eaPaths) {
    if (Test-Path $p) {
        $smbRule = "Block EA.exe Outbound SMB 445 - CVE-2026-88794"
        if (-not (Get-NetFirewallRule -DisplayName $smbRule -ErrorAction SilentlyContinue)) {
            New-NetFirewallRule -DisplayName $smbRule `
                -Direction Outbound -Program $p -Protocol TCP -RemotePort 445 `
                -Action Block -Profile Any -Enabled True | Out-Null
            Write-Host "[+] SMB block rule created for $p" -ForegroundColor Green
        }
    }
}

# 4. Verify
Get-NetFirewallRule -DisplayName "*CVE-2026-88794*" |
    Select-Object DisplayName, Enabled, Direction, Action | Format-Table -AutoSize

Remediation

There is no patch. Sparx Systems has not released a fixed build as of this writing, and ZDI-26-779 is a zero-day disclosure. Your remediation plan is therefore a compensating-controls plan until a vendor update ships:

1. Block egress from EA.exe. Apply the firewall rules in the script above (or equivalent host-firewall/EDR network policies). This kills both HTTP-based OOB exfiltration and UNC-based NTLM hash capture in one move. Allowlist only documented license/update endpoints after testing.
2. Enforce document hygiene for XSLT/XML sources. Treat .xsl, .xslt, and .xml attachments with the same suspicion as Office macros. Block or detonate them at the email gateway; require detonation verdicts before release. User interaction is the exploit's only prerequisite — break that link.
3. User guidance for EA operators. Issue a short advisory to architecture and engineering teams: do not open XSLT stylesheets or XML documents from external or untrusted sources in Enterprise Architect; do not run the XSLT Debugger against third-party transformation files; report unexpected 'file not found' or parser errors after opening external documents — those errors can be the exfil channel.
4. Block outbound SMB at the perimeter. Your enterprise edge should already deny client-to-internet TCP/445. Verify it. This is a standing control that neuters the NTLM-relay escalation path of this bug and dozens of others.
5. Pre-execution content screening. Where feasible, scan inbound .xsl/.xml files for <!ENTITY declarations containing SYSTEM URIs (especially file://, http://, and UNC paths). This is a deterministic signature for weaponized stylesheets.
6. Monitor for the patch. Track Sparx Systems' release notes and the ZDI advisory page for update references, and watch CISA KEV for any addition signaling active exploitation. When a fixed build lands, prioritize deployment to users who handle XSLT workflows.
7. Credential exposure triage. If your hunt finds historical EA.exe SMB connections to unknown hosts, treat any NTLMv2 hashes potentially captured as compromised: force password resets for the affected accounts and review for relay-based lateral movement in the same window.

The defensive posture here is a template worth keeping: document-processing desktop applications with embedded XML parsers are a recurring XXE surface, and 'the app made a network connection it never makes' remains one of the cheapest, highest-fidelity detections in the SOC playbook.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub