Autodesk Fusion CVE-2026-102637

The victim must have the Autodesk Fusion desktop application installed and registered as the handler for the Fusion protocol scheme, and must actively invoke (click/open) an attacker-crafted protocol URL whose documentName parameter contains the malicious HTML payload. Exploitation is LIMITED by required user interaction (UI:R) - the attack cannot fire without the user opening the link - and by the local attack vector (AV:L), meaning there is no autonomous remote trigger. Being reflected XSS, there is no persistence: the payload must be delivered and invoked each time. Affected builds are Fusion 2705.1.30 through versions below 2706.1.14; updating to 2706.1.14 or later removes the flaw.

Moderate-but-real priority. The CVSS 3.1 base vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, 7.1) tells a consistent story: no privileges are required (PR:N, effectively unauthenticated), complexity is low, but the attack vector is LOCAL and user interaction is REQUIRED - the victim must themselves invoke the crafted Fusion protocol URL. This UI:R + AV:L combination is the main brake on real-world risk: this is not a remotely-sprayable server flaw but a social-engineering / lure-driven desktop exploit. Note a tension worth verifying with the vendor: the description frames the trigger as a 'protocol URL' (the kind of custom URI handler a web page or chat message can reference), which has a network-delivery feel, yet CVSS assigns AV:L - the standard treatment for protocol-handler abuse, where the vulnerable parsing happens locally after the OS hands the URI to the installed app. No EPSS score is provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no PoC/exploit reference in the data, so this is not known to be actively exploited. The confidentiality and integrity impact is genuinely high (local file read and arbitrary code execution in the Fusion process context), and the vendor-assigned vuln.today decision label is 'this_week', so it warrants prompt patching rather than emergency action - consistent with the signals (patch available, no KEV, user-interaction-gated).

An attacker crafts a Fusion protocol-handler URL whose documentName parameter carries a malicious HTML/script payload, then lures a Fusion user (via email, chat, or a web page) into clicking or opening it. When the Autodesk Fusion desktop app handles the URL, the reflected XSS fires inside the app, letting the attacker read local files or run arbitrary code in the context of the Fusion process. No public exploit code or PoC reference is present in the supplied data.