What is the CVSS score of CVE-2026-0534?

CVE-2026-0534 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Autodesk Fusion are affected by CVE-2026-0534?

Autodesk Fusion allows attackers to embed malicious code in shared project files that executes when users click embedded links, potentially enabling data theft or system compromise.. A patch is available.

How to fix or mitigate CVE-2026-0534?

24 hours: Identify all Autodesk Fusion installations across the organization and obtain the vendor patch from Autodesk. 7 days: Deploy the patch organization-wide through your patch management process, prioritizing design and engineering teams. 30 days: Verify 100% patch deployment via endpoint scanning, and review Fusion file-sharing logs for suspicious activity.

Autodesk Fusion CVE-2026-0534

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-01-22 psirt@autodesk.com

XSS RCE Fusion

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 03, 2026 - 14:37 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 03, 2026 - 14:36 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 03, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Jun 03, 2026 - 14:22 NVD

7.1 (HIGH) 8.1 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 30, 2026 - 17:08 nvd

Patch available

CVE Published

Jan 22, 2026 - 17:16 nvd

HIGH 7.1

DescriptionCVE.org

A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

AnalysisAI

Stored cross-site scripting in the Autodesk Fusion desktop application allows remote attackers to embed malicious HTML in a part's attribute that, when clicked by a victim, executes script in the application context. Because Fusion is a desktop Electron-style client rather than a sandboxed browser, successful exploitation can escalate to local file read or arbitrary code execution in the user's process. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.02%, 4th percentile).

Technical ContextAI

The affected product is Autodesk Fusion (cpe:2.3:a:autodesk:fusion), a cloud-connected CAD/CAM desktop application that renders user-supplied design metadata in its UI. The root cause is CWE-79, improper neutralization of input during web page generation: attributes attached to design 'parts' are stored and later rendered without sufficient sanitization or encoding, so HTML/JavaScript persisted in those attributes is parsed by the embedded webview when a user interacts with the affected element. In desktop applications that embed a browser engine, stored XSS frequently breaks out of the page context into native APIs, which is consistent with the vendor's note that arbitrary code execution in the current process is possible.

RemediationAI

Apply the vendor-supplied update by downloading the latest Fusion client from Autodesk and installing per the security advisory at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0001; fresh installers are available at https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe (Windows) and https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg (macOS). Patch status is confirmed available per vendor advisory, but the exact fixed version is not enumerated in the provided data and must be taken from the advisory itself. Until patching is complete, restrict opening of Fusion design files received from external or untrusted parties, treat shared parts libraries as untrusted input, and consider running Fusion under a non-privileged account to limit the blast radius of arbitrary code execution; the trade-off is reduced collaboration velocity for engineering teams that routinely exchange parts.