CVE-2026-85217High· 8.6▾ TwilightA maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or consent. A successful exploit may allow an attacker to redirect authenticated…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 47.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Sep 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
0.1% → 0.2%
A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or consent. A successful exploit may allow an attacker to redirect authenticated Fusion network traffic through an attacker-controlled proxy, potentially exposing sensitive information with the current user.
Fusion >= 2705.0.0 < 2705.1.11Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-102637High· 7.1Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
CVE-2026-102636High· 7.1Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
CVE-2026-102638High· 7.1Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
CVE-2026-113775High· 7.8Dynamic Library Loading Process Control in Autodesk Fusion Desktop
CVE-2025-10244High· 8.7A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability
CVE-2026-107672High· 8.8Stack File Trusted Markdown Injection in Autodesk Fusion Post Processor Utility