Vulnerability · Published Oct 27, 2026 · Assigned by autodesk

CVE-2026-102637Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

High 7.1

In plain English

A high-severity cross-site scripting in Fusion from Autodesk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 93.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

Affected products (as reported)

Vendor	Product	Versions
Autodesk	Fusion	2705.1.30 – before 2706.1.14

Weakness: CWE-79 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

In plain English

Official description

Affected products (as reported)

References