CVE-2026-10789

A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.

CVSS v3 9.6 CRITICAL

9.6^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.8 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg	Product
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe	Product
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0008	Vendor Advisory Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:autodesk:fusion:*:*:*:*:*:*:*:*

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una página web creada con fines maliciosos, cuando es visitada por un usuario con Autodesk Fusion Desktop en ejecución y la extensión MCP habilitada, puede desencadenar una vulnerabilidad en la extensión MCP que podría permitir la ejecución de código arbitrario. Un exploit exitoso podría permitir que el código se ejecute con los privilegios del usuario actual.

Information

Published : 2026-06-22 18:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-10789

Mitre link : CVE-2026-10789

CVE.ORG link : CVE-2026-10789

JSON object : View

Products Affected

autodesk

fusion

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-10789", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10789", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-06-22T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "psirt@autodesk.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "psirt@autodesk.com", "affectedData": [{"cpes": ["cpe:2.3:a:autodesk:fusion:2703.1.11:*:*:*:*:*:*:*"], "vendor": "Autodesk", "product": "Fusion", "versions": [{"status": "affected", "version": "2703.1.11", "lessThan": "2703.1.20", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-22T18:16:30.620", "references": [{"url": "https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg", "tags": ["Product"], "source": "psirt@autodesk.com"}, {"url": "https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe", "tags": ["Product"], "source": "psirt@autodesk.com"}, {"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0008", "tags": ["Vendor Advisory", "Patch"], "source": "psirt@autodesk.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "psirt@autodesk.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user."}, {"lang": "es", "value": "Una p\u00e1gina web creada con fines maliciosos, cuando es visitada por un usuario con Autodesk Fusion Desktop en ejecuci\u00f3n y la extensi\u00f3n MCP habilitada, puede desencadenar una vulnerabilidad en la extensi\u00f3n MCP que podr\u00eda permitir la ejecuci\u00f3n de c\u00f3digo arbitrario. Un exploit exitoso podr\u00eda permitir que el c\u00f3digo se ejecute con los privilegios del usuario actual."}], "lastModified": "2026-10-25T23:10:00.167", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:fusion:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3FB8F36C-E497-438D-AF08-4EDCBD27BB4D", "versionEndExcluding": "2703.1.20"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@autodesk.com"}