7
CVEs
0
Critical
5
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
5
MEDIUM
2
LOW
0
Monthly CVE Trend
Affected Products (30)
Autocad
159
Autocad Mep
148
Autocad Plant 3D
148
Autocad Electrical
148
Autocad Architecture
148
Autocad Mechanical
148
Autocad Map 3D
126
Advance Steel
90
Civil 3D
89
Autocad Lt
76
Autocad Civil 3D
59
Autocad Advance Steel
57
Navisworks
42
Design Review
38
Revit
32
3ds Max
26
Dwg Trueview
22
Fbx Software Development Kit
20
Fusion
9
Fbx Review
9
Installer
6
Autocad P Id
6
Vred
6
Maya Usd
6
Inventor
5
Shared Components
5
Infraworks
4
3Ds Max Usd
4
Subassembly Composer
4
Alias
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-85217 | Proxy settings hijack in Autodesk Fusion Desktop (versions 2705.0.0 through 2705.1.10) allows a maliciously crafted add-in to silently overwrite the application's persistent network proxy configuration without user notification or consent, redirecting all authenticated Fusion network traffic through an attacker-controlled intermediary. The root cause is CWE-15 (External Control of System or Configuration Setting) - Fusion's add-in API imposes no authorization check or user-consent requirement on proxy configuration writes, and the modified setting persists across sessions. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; Autodesk has released a fix in version 2705.1.11 under advisory ADSK-SA-2026-0016. | HIGH | 8.6 | 0.1% | 43 |
|
| CVE-2026-16782 | Out-of-bounds read in Autodesk 3ds Max's SVG file parser enables crash, sensitive memory disclosure, or arbitrary code execution within the 3ds Max process context when a user opens a maliciously crafted SVG file. Affected releases span 3ds Max 2026 prior to 2026.3.4 and 3ds Max 2027 prior to 2027.2.0, as confirmed by EUVD-2026-65150. EPSS stands at 0.25% (16th percentile) with SSVC exploitation status of 'none,' indicating no current active exploitation; however, the RCE-capable impact triad warrants patching in affected professional environments. | HIGH | 7.8 | 0.3% | 39 |
|
| CVE-2026-16783 | Out-of-bounds write in Autodesk 3ds Max's Alembic (ABC) file parser enables arbitrary code execution in the context of the current user process when a victim opens a maliciously crafted ABC file. The vulnerability carries a CVSS 7.8 High score with high confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, but the combination of low attack complexity and full process-context code execution potential makes this a credible risk for 3ds Max users who routinely open externally sourced scene files. | HIGH | 7.8 | 0.1% | 39 |
|
| CVE-2026-19568 | Memory corruption via maliciously crafted SVG files in Autodesk 3ds Max allows arbitrary code execution within the current process context. The vulnerability is rooted in a classic buffer overflow (CWE-120) in the application's SVG parsing subsystem, triggered when a user opens a specially crafted file. Autodesk PSIRT has issued advisory ADSK-SA-2026-0014; no public exploit code or CISA KEV listing has been identified at time of analysis, though the full C/I/A impact triad warrants prompt remediation. | HIGH | 7.8 | 0.1% | 39 |
|
| CVE-2026-7455 | Out-of-bounds write in Autodesk 3ds Max's FLT file parser allows an attacker to cause a crash, corrupt data, or execute arbitrary code within the process context of the application. Exploitation requires a victim to open a specially crafted FLT (OpenFlight) file, placing this firmly in the file-borne, socially engineered delivery category. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. | HIGH | 7.8 | 0.1% | 39 |
|
| CVE-2026-14255 | Uncontrolled recursion in Autodesk Shared Components' IFC file parser allows a denial-of-service condition across multiple Autodesk products when a user opens a maliciously crafted IFC file. The recursive processing of specially structured IFC data causes stack exhaustion, terminating the application unexpectedly. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis; vendor patch is available via Autodesk Security Advisory ADSK-SA-2026-0015. | MEDIUM | 5.5 | 0.1% | 28 |
|
| CVE-2026-16781 | Uncontrolled recursion in Autodesk 3ds Max's SVG parser allows a crafted file to exhaust the call stack and crash the application, resulting in denial of service. The attack requires user interaction - a victim must open a maliciously crafted SVG file - and has no impact on confidentiality or integrity. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog. | MEDIUM | 5.5 | 0.1% | 28 |
|