PT-2026-32645 · Autodesk · Fusion

Published 2026-04-14 · Updated 2026-04-19 · CVE-2026-4345

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Autodesk Fusion (affected versions not specified)

Description A stored Cross-site Scripting (XSS) issue exists in the Autodesk Fusion desktop application. This occurs when a maliciously crafted HTML payload is stored in a design name and subsequently exported to CSV. An attacker could use this to read local files or execute arbitrary code within the context of the current process.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-4345

Affected Products

Fusion

References · 6

• https://autodesk.com/trust/security-advisories/adsk-sa-2026-0005 · Vendor Advisory
• https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg · Patch
• https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-4345 · Security Note
• https://twitter.com/CVEnew/status/2045889797890130091 · Twitter Post
• https://twitter.com/infoflowcloud/status/2045891333034774679 · Twitter Post