Skip to content
CVE PROGRAM SOURCE RECORD9.6 Critical

CVE-2026-10789

MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
autodesk

Description

A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Autodesk Fusion

Default version status: unaffected

  • 2703.1.11 to < 2703.1.20affected

References