What is the CVSS score of CVE-2026-4344?

CVE-2026-4344 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Fusion are affected by CVE-2026-4344?

Autodesk Fusion contains a stored cross-site scripting vulnerability that allows local attackers to execute arbitrary code or access sensitive files through malicious component names in the…. A patch is available.

How to fix or mitigate CVE-2026-4344?

Within 24 hours: Identify all Autodesk Fusion installations across the organization and document current versions. Within 7 days: Apply vendor-released patches to all Windows and macOS systems running Autodesk Fusion; verify patch deployment through software inventory tools. Within 30 days: Conduct audit of recent project files for suspicious component names and review access logs for unauthorized file access or code execution events.

Fusion CVE-2026-4344

EUVD-2026-22273 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-14 autodesk

GHSA-355c-p2wf-x6ff

RCE XSS Fusion

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 14:48 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 14:30 euvd

EUVD-2026-22273

Analysis Generated

Apr 14, 2026 - 14:30 vuln.today

Patch released

Apr 14, 2026 - 14:30 nvd

Patch available

CVE Published

Apr 14, 2026 - 13:56 nvd

HIGH 7.1

DescriptionCVE.org

A maliciously crafted HTML payload in a component name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

AnalysisAI

Stored XSS in Autodesk Fusion desktop application allows local attackers to execute arbitrary code or read local files through malicious component names displayed in delete confirmation dialogs. When a user clicks the crafted payload, the vulnerability escalates from XSS to potential local code execution within the application context. Vendor-released patches available for Windows and macOS. No public exploit identified at time of analysis, though the attack vector is local (CVSS:3.1/AV:L) requiring user interaction but no authentication (PR:N), with CVSS 7.1 reflecting high confidentiality and integrity impact.

Technical ContextAI

This vulnerability exploits improper neutralization of input during web page generation (CWE-79) within Autodesk Fusion's desktop application framework. The affected component is the delete confirmation dialog UI, which fails to sanitize HTML content in user-provided component names before rendering. As a desktop application, Fusion likely uses an embedded web view (Electron, CEF, or similar framework) for its interface. The stored XSS nature means the malicious payload persists in the application's data (component name field) and executes when the delete dialog is displayed. The escalation from typical XSS to local file access and code execution suggests the embedded browser context has elevated privileges or insufficient sandboxing, allowing JavaScript to break out of normal browser security boundaries and interact with the local file system or spawn processes. The CPE cpe:2.3:a:autodesk:fusion:*:*:*:*:*:*:*:* indicates all versions prior to patched releases are vulnerable.

RemediationAI

Update Autodesk Fusion to the latest patched version immediately using the official Fusion Client Downloader. Windows users should download and run the installer from https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe while macOS users should use https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg. The update process will replace vulnerable components with sanitized dialog rendering code. As an interim mitigation while testing patches, organizations should implement user awareness training about the risks of opening Fusion project files from untrusted sources and establish file provenance verification procedures. Consider restricting import of external Fusion projects to sandboxed environments until updates are applied. No workaround fully eliminates the vulnerability, making patching the primary remediation path. Verify successful update by checking the application version number against the advisory at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0005.