All vulnerabilities
CVE-2026-102636

Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

Autodesk Fusion
Open in ThreatlineRecord JSON
CVSS
7.1High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2706.1.14Fixed versionCVE List
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

Text from CVE List

Affected versions 1

  • Fusionaffected: 2705.1.30 before 2706.1.14CVE List

References 3