{"id":"CVE-2026-102637","title":"Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop","summary":"A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop applic…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"Autodesk","product":"Fusion","affected":["Fusion >= 2705.1.30 < 2706.1.14"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T16:05:20.237Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102637","references":[{"url":"https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0019"},{"url":"https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe"},{"url":"https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg"}],"tags":["cve.org"],"ingestedAt":"2026-10-27T16:32:34.416Z","slug":"CVE-2026-102637","body":"## Overview\n\nA maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.\n\n## Affected\n\n- `Fusion >= 2705.1.30 < 2706.1.14`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}