Stored Cross-site Scripting Vulnerability in Autodesk Fusion
CVE-2026-102636

7.1HIGH

Key Information:

Vendor

Autodesk
Status
Fusion
Vendor
CVE Published:
27 October 2026

What is CVE-2026-102636?

A vulnerability exists in Autodesk Fusion where a maliciously crafted HTML payload in a design name can lead to Stored Cross-site Scripting. When another user opens the affected design, this can allow an attacker to execute arbitrary code or read local files within the environment of the application, posing a significant risk to user privacy and system integrity.

Affected Version(s)

Fusion 2705.1.30 < 2706.1.14

References

https://www.autodesk.com/trust/security-advisories/adsk-s...
vendor-advisory
https://dl.appstreaming.autodesk.com/production/installer...
patch
https://dl.appstreaming.autodesk.com/production/installer...
patch

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.