CVE-2026-102637High· 7.1▾ TwilightA maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop applic…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
Fusion >= 2705.1.30 < 2706.1.14Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102636High· 7.1Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
CVE-2026-102638High· 7.1Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
CVE-2026-113775High· 7.8Dynamic Library Loading Process Control in Autodesk Fusion Desktop
CVE-2025-10244High· 8.7A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability
CVE-2026-85217High· 8.6Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktop
CVE-2026-107672High· 8.8Stack File Trusted Markdown Injection in Autodesk Fusion Post Processor Utility