Improper restriction of XML external entity reference vulnerability (CVE-2026-88794) has been found in Sparx Systems Enterprise Architect software.