What is the CVSS score of EUVD-2026-22274?

EUVD-2026-22274 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Fusion are affected by EUVD-2026-22274?

Autodesk Fusion contains a stored cross-site scripting vulnerability (CVE-2026-4345, CVSS 7.1) that allows local attackers to execute arbitrary code or access local files through malicious design…. A patch is available.

How to fix or mitigate EUVD-2026-22274?

Within 24 hours: Inventory all Autodesk Fusion installations across Windows and macOS endpoints and disable CSV export functionality via application policies if feasible. Within 7 days: Apply vendor-released patch via updated Autodesk Fusion client installers for all affected Windows and macOS systems; verify installation completion across the environment. Within 30 days: Conduct audit of recent CSV exports from Fusion to identify any suspicious design names or payloads; provide user awareness training on risks of opening exported files from untrusted sources.

Fusion EUVD-2026-22274

| CVE-2026-4345 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-04-14 autodesk

GHSA-96vp-26rc-8483

RCE XSS Fusion

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 17, 2026 - 15:22 vuln.today

cvss_changed

Analysis Generated

Apr 14, 2026 - 14:47 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 14:30 euvd

EUVD-2026-22274

Analysis Generated

Apr 14, 2026 - 14:30 vuln.today

Patch released

Apr 14, 2026 - 14:30 nvd

Patch available

CVE Published

Apr 14, 2026 - 13:56 nvd

HIGH 7.1

DescriptionCVE.org

A maliciously crafted HTML payload, stored in a design name and exported to CSV, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

AnalysisAI

Stored cross-site scripting (XSS) in Autodesk Fusion desktop application allows local attackers to execute arbitrary code or read local files by crafting malicious HTML payloads in design names that trigger when exported to CSV format. The vulnerability requires no authentication but depends on user interaction (opening the exported CSV). Vendor patch available via updated client installers for Windows and macOS. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept code identified at time of analysis.

Technical ContextAI

This is a Stored XSS vulnerability (CWE-79) affecting the Autodesk Fusion desktop application (CPE: cpe:2.3:a:autodesk:fusion). Unlike typical web-based XSS, this occurs in a desktop application context where HTML payloads embedded in design metadata (specifically design names) are not properly sanitized during CSV export operations. When a user opens the exported CSV file, the malicious script executes within the application's rendering engine or associated file handler. The local attack vector (AV:L) indicates exploitation requires the attacker to have local access or social engineer a victim into importing a malicious design file. The vulnerability's severity stems from the desktop application's elevated privileges compared to browser sandboxes, enabling filesystem access and code execution in the process context rather than being confined to typical web XSS limitations.

RemediationAI

Vendor-released patch available via updated Fusion client installers. Windows users should download and install the patched version from https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe while macOS users should use https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg. Consult the official Autodesk security advisory at https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0005 for detailed remediation instructions and specific fixed version numbers. As an interim mitigation, organizations should educate users to avoid opening design files or exported CSV data from untrusted sources, and implement application control policies to prevent execution of unexpected scripts from CSV file handlers until patches are deployed.