Read the docs
TI-2026-81403 Aliases CVE-2026-102636GHSA-x4p3-j6wq-3qmf

Stored cross-site scripting in Autodesk Fusion design names

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Autodesk Fusion desktop application from 2705.1.30 before 2706.1.14 is affected. An HTML payload embedded in a design name is not neutralized, which causes stored cross-site scripting (CWE-79). When another user opens the manipulated design and the name is displayed, an attacker can read local files or execute arbitrary code in the context of the current process. The attack requires a user to open the crafted design.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00172 6th percentileScored 2026-11-07
Fix Fixed Fusion (Autodesk): 2706.1.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AutodeskFusion2705.1.30 to before 2706.1.142706.1.14Patch availableCNA
  • Fusion VendorAutodesk Affected 2705.1.30 to before 2706.1.14 Fixed in 2706.1.14 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:autodesk:fusion:2705.1.30:*:*:*:*:*:*:*2705.1.30—Autodesk
  • cpe:2.3:a:autodesk:fusion:2705.1.30:*:*:*:*:*:*:* Versions 2705.1.30 — ·Autodesk

Remediation

Update Autodesk Fusion to version 2706.1.14 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Fusion (Autodesk) Fixed in 2706.1.14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Autodesk Fusion — autodesk.com/trust/security-advisories/adsk-sa-2026-0019

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-81416 Dynamic library loading process control in Autodesk Fusion DesktopPriority LOW 35
    • TI-2026-81405 Stored cross-site scripting in Autodesk Fusion Library ManagerPriority LOW 32
    • TI-2026-81404 Reflected cross-site scripting in Autodesk Fusion protocol URL handlingPriority LOW 32
    Show all 4 records → Advisory →

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-102636
  2. 2026-10-27 Alias added: GHSA-x4p3-j6wq-3qmf
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-11-04 CISA SSVC decision points changed

References

Patch 2

Advisory 1

  • TI-2021-08603 Path traversal in Autodesk FBX Review CVSS 3.1HIGH 7.8
  • TI-2023-13523 Memory corruption in Autodesk AutoCAD, Advance Steel and Civil 3D CVSS 3.1CRITICAL 9.8
  • TI-2023-13522 Out-of-bounds write in Autodesk AutoCAD, Advance Steel and Civil 3D CVSS 3.1CRITICAL 9.8
  • TI-2014-02375 Autodesk VRED Professional 2014 before SR1 SP8 allows remote attackers to execute… CVSS 2.0HIGH 10.0
  • TI-2008-04264 The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as… CVSS 2.0HIGH 9.3
  • TI-2008-04263 Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer… CVSS 2.0HIGH 9.3
See all 389 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences