CVE-2026-10789: critical vulnerability in Autodesk Fusion
MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop
Published · Updated
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 9.6epss 0.7%
exploitation probability
0.7%top 48% of all CVEs
observed exploitation
nono source reports it
A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
Autodesk · FusionRelated CVEs — Autodesk Fusion
In the same product, most dangerous first.
CVE-2026-0533HIGHStored XSS in Fusion desktop when attempting to delete a fileEPSS 0.7%CVE-2026-0535HIGHStored XSS in Electronic Library Component DescriptionEPSS 0.7%CVE-2026-0534HIGHStored XSS in the value of a part attributeEPSS 0.5%CVE-2025-10244HIGHHTML Payload Stored Cross-Site Scripting (XSS) VulnerabilityEPSS 0.4%CVE-2026-4344HIGHStored Cross-Site Scripting (XSS) Vulnerability in Assembly Component NameEPSS 0.3%CVE-2026-4345HIGHStored Cross-Site Scripting (XSS) Vulnerability in Design NameEPSS 0.3%