Login Request a demo
High severity · published Oct 27, 2026
CVE-2026-102637
Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
New
7.1
CVSS
–
EPSS
No
On KEV
Description
A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FU
Fusion · Autodesk
2705.1.30 before 2706.1.14 · source: vendor
Affected product
FU
Fusion
Autodesk
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102637
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102637
dl.appstreaming.autodesk.com
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg
dl.appstreaming.autodesk.com
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe
www.autodesk.com
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0019
More from Fusion
9.6
CVE-2026-10789
MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop
8.7
CVE-2025-10244
A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability
8.6
CVE-2026-85217
Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktop
8.1
CVE-2026-0535
Stored XSS in Electronic Library Component Description
8.1
CVE-2026-0534
Stored XSS in the value of a part attribute