Autodesk Fusion: Reflected Cross-site Scripting (CVE-2026-102637)
A Reflected Cross-site Scripting (XSS) vulnerability exists in the Autodesk Fusion desktop application, triggered by a maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL.
CVE search metadata
CVE search record: CVE-2026-102637. Severity: high. CVSS: 7.1. KEV: no. Product: Fusion. Brief: Autodesk Fusion: Reflected Cross-site Scripting (CVE-2026-102637). Brief link: https://feed.craftedsignal.io/briefs/2026-10-autodesk-fusion-xss/
CVE search record: CVE-2026-102638. Severity: high. CVSS: 7.1. KEV: no. Product: Fusion. Brief: Autodesk Fusion: Reflected Cross-site Scripting (CVE-2026-102637). Brief link: https://feed.craftedsignal.io/briefs/2026-10-autodesk-fusion-xss/
Triage facts
Revision 1- Applicability
- Fusion
- Evidence
- Unknown
- Severity
- High
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 27, 18:02 UTC
- Vulnerabilities
- 2 CVEs
- Source quality
- A2Roughly even chance
What's new
- 1. added CVE-2026-102638 Oct 27, 18:02 via nvd
A Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application can be triggered when a user invokes a Fusion protocol URL containing a maliciously crafted HTML payload in the 'documentName' parameter.
Impact
A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current Autodesk Fusion process.