CVE-2026-4369

Stored Cross-Site Scripting (XSS) Vulnerability in Assembly Variant Name

Published Apr 14, 2026 CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Description

A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

Analysis

Technical impact

A maliciously crafted HTML payload can be embedded in an assembly variant name and will be displayed in the delete confirmation dialog of Autodesk Fusion. If the user clicks the dialog a stored XSS is triggered, allowing an attacker to read local files or execute arbitrary code within the Fusion process context.

Affected Systems

The vulnerability affects Autodesk Fusion desktop version 2606.0. Any installation that has not been updated beyond this version may run with the unpatched code, rendering users susceptible to the exploit.

Risk and Exploitability

The flaw carries a CVSS score of 7.1, indicating moderate‑to‑high severity. Exploitation requires the victim to interact with the malicious confirmation dialog, but once triggered the impact on confidentiality and integrity is significant. EPSS data is unavailable and the issue is not listed in CISA’s KEV catalog, yet the combination of a high CVSS, required user action, and the potential for arbitrary code execution presents a realistic risk in typical environments.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Autodesk

Fusion

unaffected

Version	Status	Constraints
`2606.0`	affected	< 2702.1.47

Configuration 1 [-]

cpe:2.3:a:autodesk:fusion:*:*:*:*:*:*:*:*

No data.

Vendor Product Versions

Autodesk

Fusion

Version	Status	Scheme	Platform
`[2606.0,2702.1.47)`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Verify the installed Autodesk Fusion version and determine whether newer releases are available that contain the fix.
Install the latest Fusion update that addresses the XSS vulnerability and replace the affected program files.
Confirm that the post‑update version number exceeds 2606.0 and monitor Autodesk security advisories for any additional patches or workarounds.

Generated by OpenCVE AI on April 14, 2026 at 15:51 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.203% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0005

History

Apr 22, 2026 3:15 PM Affected versions updated View changes

Type	Values Removed	Values Added
CPEs		cpe:2.3:a:autodesk:fusion::::::::

Apr 14, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Apr 14, 2026 2:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A maliciously crafted HTML payload in an assembly variant name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
Title		Stored Cross-Site Scripting (XSS) Vulnerability in Assembly Variant Name
First Time appeared		Autodesk Autodesk fusion
Weaknesses		CWE-79
CPEs		cpe:2.3:a:autodesk:fusion:2606.0:::::::*
Vendors & Products		Autodesk Autodesk fusion
References		https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0005
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N'}`