Autodesk Fusion CVE-2026-102636

Exploitation requires that a victim open, within the Autodesk Fusion desktop application, a design whose name was crafted to contain a malicious HTML/JavaScript payload - the attacker must therefore first deliver that poisoned design to the target (e.g., through sharing or collaboration), and the payload only triggers when the design is displayed after being opened (UI:R). Limiting factors: this is a local vector (AV:L) dependent on the victim's action rather than remote unauthenticated access; it is confined to vulnerable Fusion versions in the range 2705.1.30 to <2706.1.14 and is fully addressed by updating to 2706.1.14. No special target-side configuration is stated as required, but the trigger (which component renders the design name without sanitization) is not detailed in the available sources.

This is a moderate, conditional risk rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 7.1) describes a local attack vector requiring victim interaction: a second user must open a design whose name contains a malicious HTML/JS payload, which then executes stored XSS inside the Fusion desktop process (CWE-79) and can read local files or run arbitrary code. No EPSS score was provided, the CVE is not listed in CISA KEV, and no proof-of-concept or exploit reference is present in the input - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vuln.today decision label is 'this_week', consistent with a patched, vendor-reported, interaction-dependent flaw that warrants prompt but not emergency remediation. The signals are internally consistent: local vector + required user interaction + no exploitation evidence all point to a real-but-targeted threat that depends on social delivery of a poisoned design, not mass internet-facing exploitation. Note the absence of EPSS and KEV data means widespread-exploitation likelihood cannot be quantified from the input.

An attacker crafts a Fusion design whose name embeds a malicious HTML/JavaScript payload and shares or distributes that design (e.g., via a collaboration workflow or shared project). When another user opens the manipulated design in the Fusion desktop application, the stored payload renders and executes in the application context, allowing the attacker to read local files or run arbitrary code as that user. No public PoC or exploit code is identified in the available data, and exploitation requires that a victim actually open the attacker-supplied design (UI:R).