PT-2026-4202 · Autodesk · Autodesk Fusion

Published 2026-01-22 · Updated 2026-01-22 · CVE-2026-0534

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Autodesk Fusion (affected versions not specified)

Description A specially designed HTML payload, placed within a part’s attribute and activated by a user, can lead to a Stored Cross-site Scripting (XSS) issue in the Autodesk Fusion desktop application. An attacker could potentially use this to access local files or run arbitrary code with the permissions of the current process. The vulnerability involves a malicious HTML payload stored in a part’s attribute. Clicking this payload triggers the XSS.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-01818

CVE-2026-0534

Affected Products

Autodesk Fusion

References · 7

• https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe · Patch
• https://bdu.fstec.ru/vul/2026-01818 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-0534 · Security Note
• https://autodesk.com/trust/security-advisories/adsk-sa-2026-0001 · Vendor Advisory
• https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg · Patch
• https://osv.dev/vulnerability/CVE-2026-0534 · Vendor Advisory
• https://twitter.com/CVEnew/status/2014391571119276453 · Twitter Post