What is the CVSS score of CVE-2026-0535?

CVE-2026-0535 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Autodesk Fusion are affected by CVE-2026-0535?

Autodesk Fusion users face a code-execution vulnerability triggered through malicious component descriptions, potentially compromising design assets and workstation integrity.. A patch is available.

How to fix or mitigate CVE-2026-0535?

Within 24 hours: Identify and inventory all systems running Autodesk Fusion, documenting currently installed versions. Within 7 days: Deploy the patch released via Autodesk security advisory ADSK-SA-2026-0001 to all affected Fusion installations. Within 30 days: Complete comprehensive patching compliance verification across all Autodesk Fusion systems and maintain deployment documentation.

Autodesk Fusion CVE-2026-0535

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-01-22 psirt@autodesk.com

XSS RCE Fusion

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Updated

Jun 03, 2026 - 14:36 vuln.today

v3 (cvss_changed)

Analysis Updated

Jun 03, 2026 - 14:35 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 03, 2026 - 14:22 vuln.today

cvss_changed

CVSS changed

Jun 03, 2026 - 14:22 NVD

7.1 (HIGH) 8.1 (HIGH)

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Jan 30, 2026 - 17:07 nvd

Patch available

CVE Published

Jan 22, 2026 - 17:16 nvd

HIGH 7.1

DescriptionCVE.org

A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

AnalysisAI

Stored cross-site scripting in the Autodesk Fusion desktop application allows a malicious actor to embed an HTML payload in a component's description that, when clicked by another user, can read local files or execute arbitrary code in the context of the Fusion process. The vulnerability requires user interaction but no authentication on the victim side, and Autodesk has released a patch via security advisory ADSK-SA-2026-0001. No public exploit identified at time of analysis and EPSS exploitation probability is very low at 0.02%.

Technical ContextAI

Autodesk Fusion is a desktop CAD/CAM/CAE application that renders portions of its UI - including component metadata such as descriptions - using an embedded web/HTML rendering layer (typical of Electron- or CEF-based desktop apps). The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation): component description fields are stored without sanitization and later rendered as HTML, allowing injected script to execute inside the application chrome. Because the rendering context is the desktop process rather than a sandboxed browser tab, script execution can reach native APIs, enabling local file reads and arbitrary code execution in the user's session. The affected CPE is cpe:2.3:a:autodesk:fusion:*:*:*:*:*:*:*:*, indicating all versions of the Fusion desktop client prior to the fix.

RemediationAI

Patch available per vendor advisory: upgrade Autodesk Fusion to the fixed build referenced in ADSK-SA-2026-0001 (https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0001), reinstalling via the official Fusion Client Downloader if needed. Until the patch is rolled out organization-wide, restrict ingestion of Fusion components from untrusted sources - block or quarantine third-party component libraries and shared cloud projects from unknown collaborators, and instruct users not to click into descriptions on unfamiliar components (trade-off: disrupts collaboration workflows that rely on community or vendor-supplied parts). Where Fusion is used in regulated or high-value engineering environments, consider running it in a non-privileged Windows account so that any code executed via this XSS inherits reduced filesystem and network reach (trade-off: licensing and team-data-cache locations may need reconfiguration).