ADP Desktop SDK EUVD-2026-101473

Exploitation requires that the ADP Desktop SDK actually transmit sensitive data (credentials/tokens for Autodesk services) over an unencrypted channel, and that the attacker be able to observe that transmission. The published vector adds significant limiting factors: AV:L implies the attacker needs local access to the host rather than remote network reach, AC:H indicates a non-trivial precondition such as achieving a man-in-the-middle/observation position, PR:L requires the attacker to already hold some privileges, and UI:R requires a legitimate user to perform an action (e.g., run the SDK/trigger the transmission). These constraints meaningfully narrow realistic exploitation to scenarios where an attacker already has a local foothold or on-path visibility when the victim uses the affected SDK.

Despite a HIGH 7.5 CVSS base score, the published vector describes a constrained attack: AV:L (local), AC:H (high complexity), PR:L (requires some privileges) and UI:R (user interaction), which together substantially lower real-world exploitability relative to the raw score - the triple C:H/I:H/A:H impact plus S:C (scope change) is what inflates the number, not ease of attack. No EPSS probability was supplied, there is NO CISA KEV listing, and NO public exploit was identified, so there is no evidence of active or widespread exploitation; this reads as a vendor-reported hygiene issue rather than an urgent in-the-wild priority. A notable conflict: CWE-319 (cleartext transmission of sensitive information) normally implies a network/man-in-the-middle exposure, yet the published CVSS specifies AV:L (local) - these signals disagree and should be verified with Autodesk, because they imply very different threat models (passive network sniffing vs. a local attacker). Affected versions are also unspecified (CPE wildcard only). Net: a genuine confidentiality/credential-exposure flaw worth patching, but currently a moderate, non-emergency priority given no exploitation signal and a high-complexity, user-interaction-dependent vector.

An attacker positioned to observe traffic from the ADP Desktop SDK captures sensitive data (likely authentication tokens or credentials) that the SDK transmits without encryption, then replays those credentials to gain unauthorized access to the victim's Autodesk cloud services. No public proof-of-concept exploit was identified at the time of analysis, and the published vector's AV:L/AC:H/UI:R metrics indicate the attack is not trivial and may require local positioning or user action.