Vulnerability record · CVE-2026-10789 · published 22 June 2026

CVE-2026-10789: Autodesk fusion code injection vulnerability

Autodesk · Fusion

A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.

9.6 CVSS 3.1 Critical EPSS 0.70% · top 48.7% CWE-94 · Code injection

9.6CVSS 3.1 base score

0.70%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References

24 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Fusion Autodesk

References

Link	Tags
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg	Product
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe	Product
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0008	Vendor AdvisoryPatch

Track CVE-2026-10789 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2025-10244Autodesk fusion cross-site scripting vulnerabilityA maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnera…EPSS 0.45%23 Sep 2025 8.1CVE-2026-0535Autodesk fusion cross-site scripting vulnerabilityA maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulner…EPSS 0.67%22 Jan 2026 8.1CVE-2026-0534Autodesk fusion cross-site scripting vulnerabilityA maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability…EPSS 0.55%22 Jan 2026 8.1CVE-2026-0533Autodesk fusion cross-site scripting vulnerabilityA maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored…EPSS 0.69%22 Jan 2026 7.8CVE-2021-40162Autodesk autocad out-of-bounds read vulnerabilityA maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond allocated boundaries when pars…EPSS 0.93%7 Oct 2022 7.8CVE-2021-40163Autodesk autocad out-of-bounds write vulnerabilityA Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through Autodesk Image Processing component.EPSS 0.93%7 Oct 2022 7.8CVE-2021-40164Autodesk autocad out-of-bounds write vulnerabilityA heap-based buffer overflow could occur while parsing TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code.EPSS 0.94%7 Oct 2022 7.8CVE-2021-40165Autodesk autocad out-of-bounds write vulnerabilityA maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond the allocated buffer while pars…EPSS 0.93%7 Oct 2022

Source: NIST National Vulnerability Database (record CVE-2026-10789), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.