VulnSocial

CVE-2025-15621Disclosure(sparxsystems / enterprise_architect)

LOWCVSS 6.0 · MEDIUM

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

  • Prioritize remediation for sparxsystems enterprise_architect systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication

sparxsystems CVEsBack to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-522

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • enterprise_architect

Threat summary

  • Active exploitation appears in 1 classified signals
  • 4 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • General: 1 classified signal
  • Peaked 1d ago at 3 mentions (2026-04-17); latest day: 1
  • 4 total mentions across 2 days

Affected systems

Vendors
sparxsystems
Products
enterprise_architect

Deep dive

Activity timeline4 mentions / 2d
01223Mentions · 2026-04-17: 3Mentions · 2026-08-22: 1Active Exploitation · 2026-04-17: 1Technical Details · 2026-04-17: 204-1708-22
Signal classification3 categories
Disclosure
250.0%
Active Exploitation
125.0%
General
125.0%
Referenced assets4 URLs
Classification over time
DateTotalLabels
2026-04-173
Active Exploitation1Disclosure2
2026-08-221
General1
Full discourse4 posts
  • DailyCVE@dailycve
    General

    🟠 Sparx Enterprise Architect, Insufficiently Protected Credentials, #CVE-2025-15621 (Medium) -DC-Aug2026-1759 https://dailycve.com/sparx-enterprise-architect-insufficiently-protected-credentials-cve-2025-15621-medium-dc-aug2026-1759/

    Post summary

    The post merely lists the CVE for Sparx Enterprise Architect with a severity note, providing no further technical or exploit details.

    0000034
    230 followersView on X
  • VulDB 🛡@vuldb
    Active Exploitation

    Our CTI team identified a lot of activities targeting Sparx Systems Sparx Enterprise Architect (CVE-2025-15621) https://vuldb.com/vuln/357920/cti

    Post summary

    CTI reports numerous activities targeting CVE-2025-15621 in Sparx Enterprise Architect, indicating active exploitation in the wild.

    00000549
    2.1K followersView on X
  • Infoflowcloud@infoflowcloud
    Disclosure

    🚨*CVE* CVE-2025-15621 Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID aut… https://www.cve.org/CVERecord?id=CVE-2025-15621 ----- Traducción: CVE-2025-15621 Cre… http://infoflow.cloud`

    Post summary

    The post announces CVE‑2025‑15621, detailing an insufficiently protected credential flaw in Sparx Enterprise Architect and links to the official CVE record.

    00000537
    71 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2025-15621 Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID aut… https://www.cve.org/CVERecord?id=CVE-2025-15621

    Post summary

    The post cites CVE‑2025‑15621 in Sparx Enterprise Architect, highlighting a credential verification flaw in OAuth2/OpenID, but provides no PoC, exploit, or patch information.

    00000283
    57.2K followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appsparxsystemsenterprise_architect---

Explore more

Back to dashboardsparxsystems CVEsenterprise_architect vulnerabilities