49
CVEs
1
Critical
40
High
0
KEV
0
PoC
17
Unpatched C/H
65.3%
Patch Rate
0.1%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
40
MEDIUM
8
LOW
0
Monthly CVE Trend
Affected Products (30)
Autocad
159
Autocad Mep
148
Autocad Plant 3D
148
Autocad Electrical
148
Autocad Architecture
148
Autocad Mechanical
148
Autocad Map 3D
126
Advance Steel
90
Civil 3D
89
Autocad Lt
76
Autocad Civil 3D
59
Autocad Advance Steel
57
Navisworks
42
Design Review
38
Revit
32
3ds Max
26
Dwg Trueview
22
Fbx Software Development Kit
20
Fusion
9
Fbx Review
9
Installer
6
Autocad P Id
6
Vred
6
Maya Usd
6
Inventor
5
Shared Components
5
Infraworks
4
3Ds Max Usd
4
Subassembly Composer
4
Alias
3
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-10789 | Remote code execution in Autodesk Fusion Desktop's MCP (Model Context Protocol) extension allows attackers to execute arbitrary code with current user privileges when a victim visits a malicious webpage while Fusion is running with the MCP extension enabled. The flaw is rated CVSS 9.6 (Critical) due to its network-reachable nature and scope change, though successful exploitation requires user interaction (visiting a crafted page) and the non-default MCP extension being enabled. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV. | CRITICAL | 9.6 | 0.3% | 48 |
|
| CVE-2026-85217 | Proxy settings hijack in Autodesk Fusion Desktop (versions 2705.0.0 through 2705.1.10) allows a maliciously crafted add-in to silently overwrite the application's persistent network proxy configuration without user notification or consent, redirecting all authenticated Fusion network traffic through an attacker-controlled intermediary. The root cause is CWE-15 (External Control of System or Configuration Setting) - Fusion's add-in API imposes no authorization check or user-consent requirement on proxy configuration writes, and the modified setting persists across sessions. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; Autodesk has released a fix in version 2705.1.11 under advisory ADSK-SA-2026-0016. | HIGH | 8.6 | 0.1% | 43 |
|
| CVE-2026-0538 | Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted GIF file, triggering an out-of-bounds write (CWE-787) in its image-handling code. The flaw lets an attacker run code in the context of the user running 3ds Max; no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.03%. | HIGH | 8.4 | 0.0% | 42 |
No patch
|
| CVE-2026-0537 | Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, triggering an out-of-bounds write (CWE-787) that corrupts memory in the running process. Exploitation requires a victim to open the malicious file locally, but no public exploit has been identified at time of analysis and EPSS rates real-world exploitation likelihood at just 0.01%. The flaw was reported by Autodesk PSIRT and is tracked under advisory ADSK-SA-2026-0002. | HIGH | 8.4 | 0.0% | 42 |
No patch
|
| CVE-2026-0661 | Arbitrary code execution in Autodesk 3ds Max occurs when the application parses a maliciously crafted RGB image file, resulting in a CWE-787 out-of-bounds write that corrupts memory and lets an attacker run code in the context of the user running 3ds Max. No public exploit identified at time of analysis, and the EPSS probability is only 0.01%, but the CVSS base score of 8.4 reflects the high impact when a victim is convinced to open a weaponized asset file. | HIGH | 8.4 | 0.0% | 42 |
No patch
|
| CVE-2026-0660 | Stack-based buffer overflow in Autodesk 3ds Max enables arbitrary code execution when the application parses a maliciously crafted GIF file, running attacker code in the context of the current user process. The flaw carries a CVSS 8.4 (High) rating due to local attack vector but full confidentiality, integrity, and availability impact, with no public exploit identified at time of analysis and a very low EPSS probability (0.01%) reflecting the file-open user-interaction model typical of DCC software. | HIGH | 8.4 | 0.0% | 42 |
No patch
|
| CVE-2026-0533 | Stored cross-site scripting in the Autodesk Fusion desktop application allows remote attackers to embed a malicious HTML payload in a design name that executes when a user opens the delete confirmation dialog and clicks the rendered content. Successful exploitation can lead to local file disclosure or arbitrary code execution in the context of the Fusion process. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.04%, 11th percentile). | HIGH | 8.1 | 0.0% | 41 |
|
| CVE-2026-0535 | Stored cross-site scripting in the Autodesk Fusion desktop application allows a malicious actor to embed an HTML payload in a component's description that, when clicked by another user, can read local files or execute arbitrary code in the context of the Fusion process. The vulnerability requires user interaction but no authentication on the victim side, and Autodesk has released a patch via security advisory ADSK-SA-2026-0001. No public exploit identified at time of analysis and EPSS exploitation probability is very low at 0.02%. | HIGH | 8.1 | 0.0% | 41 |
|
| CVE-2026-0534 | Stored cross-site scripting in the Autodesk Fusion desktop application allows remote attackers to embed malicious HTML in a part's attribute that, when clicked by a victim, executes script in the application context. Because Fusion is a desktop Electron-style client rather than a sandboxed browser, successful exploitation can escalate to local file read or arbitrary code execution in the user's process. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.02%, 4th percentile). | HIGH | 8.1 | 0.0% | 41 |
|
| CVE-2026-16782 | Out-of-bounds read in Autodesk 3ds Max's SVG file parser enables crash, sensitive memory disclosure, or arbitrary code execution within the 3ds Max process context when a user opens a maliciously crafted SVG file. Affected releases span 3ds Max 2026 prior to 2026.3.4 and 3ds Max 2027 prior to 2027.2.0, as confirmed by EUVD-2026-65150. EPSS stands at 0.25% (16th percentile) with SSVC exploitation status of 'none,' indicating no current active exploitation; however, the RCE-capable impact triad warrants patching in affected professional environments. | HIGH | 7.8 | 0.3% | 39 |
|
| CVE-2026-10709 | Stack-based buffer overflow in Autodesk FBX SDK's binary file parser allows arbitrary code execution when a user opens a maliciously crafted FBX file. The vulnerable function `fbxsdk::FbxIO::BinaryReadSectionHeader` fails to properly bound-check attacker-controlled data from binary section headers, overflowing the call stack and enabling control-flow hijacking in the context of the host process. Any application embedding the affected SDK version - including Autodesk DCC tools and third-party game engine editors - is exposed when users import FBX assets from untrusted sources; no public exploit or CISA KEV listing has been identified at time of analysis. | HIGH | 7.8 | 0.1% | 39 |
|
| CVE-2026-10710 | Stack-based buffer overflow in Autodesk FBX SDK's fbxsdk::ExtractDrive function allows arbitrary code execution in the context of the current process when a user opens a maliciously crafted FBX file. Any application embedding the FBX SDK for 3D asset import - including game engines, VFX pipelines, and CAD tools - inherits this attack surface, making the blast radius broader than the SDK itself. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high-impact CVSS score (7.8) and RCE primitive make this a priority for organizations ingesting untrusted 3D content. | HIGH | 7.8 | 0.1% | 39 |
|
| CVE-2026-11803 | Out-of-bounds read in Autodesk Revit's PDF parsing engine exposes users to crashes, sensitive memory disclosure, and arbitrary code execution within the Revit process when opening a maliciously crafted PDF file. Affected are users of Autodesk Revit across versions covered by advisory ADSK-SA-2026-0011, with the attack requiring only that a target be socially engineered into opening a weaponized PDF - a realistic threat vector for AEC-industry professionals who routinely exchange PDF documents. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists, though the high C/I/A impact profile makes this a meaningful risk for targeted attacks against Revit users. | HIGH | 7.8 | 0.1% | 39 |
|
| CVE-2026-1289 | Use-After-Free in Autodesk Revit's PDF parser allows arbitrary code execution, sensitive data disclosure, or application crash when a user opens a maliciously crafted PDF file. Affected versions span Revit 2026 (prior to 2026.5.0) and Revit 2027 (prior to 2027.2.0), with full high-impact potential across confidentiality, integrity, and availability. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available via advisory ADSK-SA-2026-0011. | HIGH | 7.8 | 0.1% | 39 |
|
| CVE-2026-16463 | Arbitrary code execution in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView occurs when a user opens a maliciously crafted DXF file, triggering a heap-based buffer overflow (CWE-122) in the file parser. A local attacker who convinces a victim to open the file can crash the application, read sensitive in-process memory, or run code in the context of the current user. There is no public exploit identified at time of analysis, and the file-format vector plus required user interaction places this in the classic 'malicious drawing file' threat model rather than remote mass exploitation. | HIGH | 7.8 | 0.1% | 39 |
|