Advisoriesby IbisAutodeskCVE-2026-102636
Autodesk Fusion: cross-site scripting
Fix: upgrade to 2706.1.14 or later
A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Fusion Product | >= 2705.1.30, < 2706.1.14 | 2706.1.14 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-79
- www.cve.org/CVERecord?id=CVE-2026-102636
- nvd.nist.gov/vuln/detail/CVE-2026-102636
- dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg
- dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe
- www.autodesk.com/trust/security-advisories/adsk-sa-2026-0019