TI-2026-58542 Aliases CVE-2026-85217 GHSA-637g-92jv-5383

Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion Desktop

LOW 38CWE-15Published 2026-09-10 · Updated 2026-09-11

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A maliciously crafted add-in, when installed and executed in Autodesk Fusion Desktop, can modify persistent network proxy settings without user notification or consent. A successful exploit may allow an attacker to redirect authenticated Fusion network traffic through an attacker-controlled proxy, potentially exposing sensitive information with the current user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00187 8th percentileScored 2026-11-07

Fix Fixed Fusion (Autodesk): 2705.1.11

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Autodesk	Fusion	2705.0.0 to before 2705.1.11	2705.1.11	Patch available	CNA

Fusion VendorAutodesk Affected 2705.0.0 to before 2705.1.11 Fixed in 2705.1.11 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:autodesk:fusion:2705:::::::*	2705	—	Autodesk

cpe:2.3:a:autodesk:fusion:2705:*:*:*:*:*:*:* Versions 2705 — ·Autodesk

Remediation

Fix · CNA Fusion (Autodesk) Fixed in 2705.1.11

Timeline

2026-10-02 Threatist record created from CVE-2026-85217
2026-10-03 Alias added: GHSA-637g-92jv-5383

References

Patch 1

https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe

Advisory 1

https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0016

TI-2021-08603 Path traversal in Autodesk FBX Review CVSS 3.1HIGH 7.8
TI-2023-13523 Memory corruption in Autodesk AutoCAD, Advance Steel and Civil 3D CVSS 3.1CRITICAL 9.8
TI-2023-13522 Out-of-bounds write in Autodesk AutoCAD, Advance Steel and Civil 3D CVSS 3.1CRITICAL 9.8
TI-2014-02375 Autodesk VRED Professional 2014 before SR1 SP8 allows remote attackers to execute… CVSS 2.0HIGH 10.0
TI-2008-04264 The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as… CVSS 2.0HIGH 9.3
TI-2008-04263 Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer… CVSS 2.0HIGH 9.3

See all 389 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences