vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2026-102637

Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop

HIGH
7.1
CVSS Score
Published: October 27, 2026 at 04:05 PM UTC
Updated: October 28, 2026 at 03:21 PM UTC
1 product affected across 1 vendorFusion

Using Fusion by Autodesk?

Get instant alerts when new vulnerabilities affect Fusion - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.1
Exploit prediction
EPSS 0.2%

Description

A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

References (3)

Vendor Advisory
Source: cverecord
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0019
Patch
Source: cverecord
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe
Patch
Source: cverecord
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg

CVSS

7.1HIGHautodesk
Attack Vector
LOCAL
Complexity
LOW
Privileges
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Vector?

Quick Info

StatusAWAITING ANALYSIS
CWE
CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card