What is the CVSS score of CVE-2026-10789?

CVE-2026-10789 has a CVSS 3.1 base score of 9.6 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Autodesk Fusion are affected by CVE-2026-10789?

Autodesk Fusion Desktop contains a critical remote code execution vulnerability (CVSS 9.6) in the MCP extension that allows attackers to execute arbitrary code with user privileges through malicious…. A patch is available.

How to fix or mitigate CVE-2026-10789?

Within 24 hours: Audit users with MCP extension enabled in Fusion Desktop; disable the extension if not actively required. Within 7 days: Apply Autodesk's vendor-released patch to all affected Fusion Desktop installations once available. Within 30 days: Verify patch deployment across all systems and document business justification for any re-enabled MCP extensions.

Autodesk Fusion CVE-2026-10789

EUVD-2026-38328 CRITICAL

Code Injection (CWE-94)

2026-06-22 autodesk

GHSA-fp83-vjxr-x824

RCE Code Injection Fusion

9.6

CVSS 3.1 · Vendor: autodesk

Severity by source

Vendor (autodesk) PRIMARY

9.6 CRITICAL

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

vuln.today AI

9.6 CRITICAL

Browser-delivered payload reaches a local MCP listener (AV:N, UI:R), no auth needed (PR:N), and code execution crosses from web to desktop context yielding full user-level CIA impact with scope change.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (autodesk).

CVSS VectorVendor: autodesk

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 17:52 vuln.today

DescriptionCVE.org

A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.

AnalysisAI

Remote code execution in Autodesk Fusion Desktop's MCP (Model Context Protocol) extension allows attackers to execute arbitrary code with current user privileges when a victim visits a malicious webpage while Fusion is running with the MCP extension enabled. The flaw is rated CVSS 9.6 (Critical) due to its network-reachable nature and scope change, though successful exploitation requires user interaction (visiting a crafted page) and the non-default MCP extension being enabled. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Autodesk Fusion is a cloud-based CAD/CAM/CAE platform with a desktop client that supports an MCP (Model Context Protocol) extension - a mechanism typically used to bridge local applications with AI assistants or other tooling. The underlying weakness is CWE-94 (Improper Control of Generation of Code, i.e., Code Injection), meaning the MCP extension processes attacker-controllable input from a web origin without sufficient sanitization, enabling code execution paths to be reached. The affected CPE is cpe:2.3:a:autodesk:fusion:*:*:*:*:*:*:* indicating all unspecified versions of the Fusion desktop client are within scope until patched.

RemediationAI

Apply the patched Autodesk Fusion client by downloading the latest installer from https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe (Windows) or https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg (macOS), and consult the advisory at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0008 for exact fixed version numbers (patch available per vendor advisory). As an interim workaround, disable the MCP extension within Fusion until the update is applied - this removes the vulnerable code path entirely at the cost of losing MCP-based integrations with AI tools or external clients. Additionally, instruct users to fully close Fusion when not actively in use (the exploit chain requires the desktop app to be running) and consider browser-level controls such as restricting design engineering workstations from general web browsing.