EUVD-2025-209512

Contact Sparx Systems immediately to confirm patch availability and recommended upgrade path. If a patched version is available, upgrade to the latest release specified by Sparx Systems, paying particular attention to any security-specific update notes in the release history. If no patch is yet available, implement the following compensating controls: (1) Restrict file system access to the Sparx Enterprise Architect configuration and cache directories (typically %APPDATA%\Sparx Systems on Windows) using OS-level access controls, limiting to the specific user account running the application-this prevents lateral credential extraction by other user accounts or malware; (2) disable or restrict OpenID authentication in Sparx Enterprise Architect if an alternative authentication method is available, reducing the exposure window for credential misuse; (3) use endpoint detection and response (EDR) tools to monitor for unauthorized access to configuration directories and for suspicious authentication token requests originating from the local network; (4) revoke or rotate OAuth2 client credentials registered with any OpenID provider that Sparx Enterprise Architect authenticates to, then re-register the application with the vendor-recommended process once a patch is confirmed-this invalidates any extracted credentials currently in attacker hands. The trade-off of restricting file access is reduced usability for system administration tasks, but the security benefit justifies this in sensitive environments. Consult Sparx Systems advisory and NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2025-15622) for the most current guidance.