What is the CVSS score of CVE-2026-4369?

CVE-2026-4369 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Fusion are affected by CVE-2026-4369?

Autodesk Fusion desktop application contains a stored cross-site scripting vulnerability that permits arbitrary code execution through malicious assembly variant names, exposing users to local file…. A patch is available.

How to fix or mitigate CVE-2026-4369?

Within 24 hours: Inventory all Autodesk Fusion installations across engineering and design teams; notify users to avoid deleting assembly variants from untrusted sources. Within 7 days: Deploy vendor-released patch via official Fusion client installers to all Windows and macOS systems running Fusion; verify installation completion through client version reporting. Within 30 days: Conduct audit of Fusion projects opened in past 90 days from external or collaborative sources; review file access logs for unauthorized activity correlating to Fusion process execution.

Fusion CVE-2026-4369

EUVD-2026-22276 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-14 autodesk

GHSA-mm54-xvph-7p9r

RCE XSS Fusion

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 14:48 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 14:30 euvd

EUVD-2026-22276

Analysis Generated

Apr 14, 2026 - 14:30 vuln.today

Patch released

Apr 14, 2026 - 14:30 nvd

Patch available

CVE Published

Apr 14, 2026 - 13:47 nvd

HIGH 7.1

DescriptionCVE.org

A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

AnalysisAI

Stored cross-site scripting in Autodesk Fusion desktop application enables arbitrary code execution when malicious assembly variant names render in delete confirmation dialogs. Attackers can craft HTML payloads that execute in the application context, enabling local file access and code execution with user privileges (CVSS 7.1, local attack vector requiring user interaction). Vendor-released patch available via official Fusion client installers for Windows and macOS. No public exploit identified at time of analysis.

Technical ContextAI

This is a CWE-79 Stored XSS vulnerability affecting the Autodesk Fusion desktop application (CPE: cpe:2.3:a:autodesk:fusion). Unlike typical web-based XSS, this occurs in a desktop application context where assembly variant names-likely stored in project files or cloud-synced data-are rendered without proper HTML encoding in native UI dialog boxes. When the delete confirmation dialog displays the malicious variant name, the embedded HTML/JavaScript payload executes within the Electron or embedded browser component used by Fusion's interface. This bridges web exploitation techniques into desktop software, where JavaScript execution can access Node.js APIs or native file system capabilities depending on the application's security sandbox configuration. The stored nature means the payload persists in project data, affecting anyone who opens the malicious assembly.

RemediationAI

Update Autodesk Fusion to the latest version using the official client downloader released March 2026. Windows users should download and run the patched installer from https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe while macOS users should use https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg. The update process will install the version containing fixes for the XSS vulnerability in assembly variant name rendering. As a temporary mitigation until patching is complete, exercise caution when opening Fusion project files from untrusted sources and avoid deleting assembly variants in projects received from external parties without first verifying file integrity. Review Autodesk Security Advisory ADSK-SA-2026-0005 for additional guidance and version verification procedures.