Read the docs
TI-2026-81404 Aliases CVE-2026-102637GHSA-x5j6-5fc7-vwh7

Reflected cross-site scripting in Autodesk Fusion protocol URL handling

Priority LOW 32CWE-79Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Autodesk Fusion desktop application from 2705.1.30 before 2706.1.14 contains a reflected cross-site scripting flaw (CWE-79) in the documentName parameter of Fusion protocol URLs. When a user invokes a crafted protocol URL, the injected HTML runs in the application, letting an attacker with user interaction read local files or execute arbitrary code in the context of the current process. The flaw has a CVSS 3.1 base score of 7.1 (HIGH) and is not listed in CISA KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00172 6th percentileScored 2026-11-07
Fix Fixed Fusion (Autodesk): 2706.1.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AutodeskFusion2705.1.30 to before 2706.1.142706.1.14Patch availableCNA
  • Fusion VendorAutodesk Affected 2705.1.30 to before 2706.1.14 Fixed in 2706.1.14 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:autodesk:fusion:2705.1.30:*:*:*:*:*:*:*2705.1.30—Autodesk
  • cpe:2.3:a:autodesk:fusion:2705.1.30:*:*:*:*:*:*:* Versions 2705.1.30 — ·Autodesk

Remediation

Update Autodesk Fusion to version 2706.1.14 or later, which fixes the flaw. Autodesk lists 2706.1.14 as the only fixed version.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Fusion (Autodesk) Fixed in 2706.1.14

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Autodesk Fusion — autodesk.com/trust/security-advisories/adsk-sa-2026-0019

    4 records Highest priority Priority LOW 4 LOW

    Other records, highest priority first

    • TI-2026-81416 Dynamic library loading process control in Autodesk Fusion DesktopPriority LOW 35
    • TI-2026-81405 Stored cross-site scripting in Autodesk Fusion Library ManagerPriority LOW 32
    • TI-2026-81403 Stored cross-site scripting in Autodesk Fusion design namesPriority LOW 32
    Show all 4 records → Advisory →

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-102637
  2. 2026-10-27 Alias added: GHSA-x5j6-5fc7-vwh7
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-11-04 CISA SSVC decision points changed

References

Patch 2

Advisory 1

  • TI-2021-08603 Path traversal in Autodesk FBX Review CVSS 3.1HIGH 7.8
  • TI-2023-13523 Memory corruption in Autodesk AutoCAD, Advance Steel and Civil 3D CVSS 3.1CRITICAL 9.8
  • TI-2023-13522 Out-of-bounds write in Autodesk AutoCAD, Advance Steel and Civil 3D CVSS 3.1CRITICAL 9.8
  • TI-2014-02375 Autodesk VRED Professional 2014 before SR1 SP8 allows remote attackers to execute… CVSS 2.0HIGH 10.0
  • TI-2008-04264 The UpdateEngine class in the LiveUpdate ActiveX control (LiveUpdate16.DLL 17.2.56), as… CVSS 2.0HIGH 9.3
  • TI-2008-04263 Directory traversal vulnerability in the CExpressViewerControl class in the DWF Viewer… CVSS 2.0HIGH 9.3
See all 389 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences