CVE-2026-4345 Autodesk CVE debrief

Who should care

Defenders responsible for Autodesk Fusion installations, particularly those handling user-supplied design names, should assess exposure and prioritize verification and remediation efforts to prevent potential XSS attacks.

Why it matters

CVE-2026-4345 is a Stored Cross-site Scripting (XSS) vulnerability in Autodesk Fusion that allows attackers to potentially read local files or execute code. Defenders should verify and update installations, implement input validation, and monitor logs to prevent and detect potential attacks.

• Read local files in the context of the current process.
• Execute arbitrary code in the context of the current process.
• Potential data theft or unauthorized access through XSS.
• Verification of Autodesk Fusion version and exposure is required.

Technical summary

The Autodesk Fusion desktop application is vulnerable to Stored Cross-site Scripting (XSS) when a maliciously crafted HTML payload is stored in a design name and exported to CSV. This could allow an attacker to read local files or execute arbitrary code in the context of the current process. The vulnerability has a CVSS score of 7.1 and is considered HIGH severity. The issue arises from improper handling of user-supplied design names, which can be exploited to inject malicious code. Defenders should prioritize verifying and updating Autodesk Fusion installations, especially those handling user-supplied design names, to prevent potential XSS attacks.

Defensive priority

Defenders should prioritize verifying and updating Autodesk Fusion installations, especially those handling user-supplied design names, to prevent potential XSS attacks.

Recommended defensive actions

• Verify and update Autodesk Fusion installations to the latest version (2702.1.47 or later) to address the Stored XSS vulnerability.
• Implement input validation and output encoding for design names to prevent XSS attacks.
• Monitor Autodesk Fusion logs for suspicious activity related to design name exports.
• Restrict access to sensitive features and data within Autodesk Fusion to minimize potential impact.
• Perform vulnerability scanning and penetration testing to identify potential entry points.
• Develop and implement incident response plans to address potential security breaches.
• Conduct regular security audits and risk assessments to identify and mitigate potential vulnerabilities.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 7.1 and HIGH severity. Autodesk has released a security advisory (ADSK-SA-2026-0005) addressing this issue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.