CVE Intelligence
Analysis AI-assisted

CVE-2026-10789: Autodesk Fusion MCP Extension Code Injection Vulnerability

Autodesk has disclosed a critical code injection flaw in the MCP extension of Autodesk Fusion. According to the record, a maliciously crafted webpage visited by a user with Fusion Desktop running and the extension enabled could lead to arbitrary code execution with that user's privileges. Versions earlier than 2703.1.20 are listed as affected, and a vendor patch is referenced.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-10789 is a code injection weakness (CWE-94) in the MCP extension of Autodesk Fusion. According to the record, the trigger is a maliciously crafted webpage that a user visits while Fusion Desktop runs with the MCP extension enabled. The CNA rates it critical with a CVSS 3.1 base score of 9.6.

Impact

  • The record states that arbitrary code execution may be possible.
  • Code would run with the privileges of the current user.
  • The CVSS metrics in the record describe a network attack vector, low complexity, no privileges required, user interaction required, changed scope, and high impact to confidentiality, integrity and availability.

Affected products and versions

  • Autodesk Fusion versions below 2703.1.20 are listed as affected.
  • The record does not break down other builds, platforms or editions.

Exploitation status

The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation in the wild appears in the sources consulted for this analysis.

Remediation and mitigation

  • Update Autodesk Fusion to version 2703.1.20 or later, following the vendor advisory ADSK-SA-2026-0008.
  • Confirm the exact fixed build in the advisory, because the record gives only the affected range.
  • Until the update is applied, avoid opening untrusted websites on systems where Fusion runs with the MCP extension enabled.
  • If the MCP extension is not needed, consider disabling it as a temporary measure (inference based on the described trigger).

Detection guidance

  • Inventory Autodesk Fusion installations and record their versions to identify those below 2703.1.20.
  • Review endpoint telemetry for unexpected child processes launched by Fusion or by browser sessions interacting with it.
  • Treat unexplained code execution under a user context on these systems as a priority for investigation.

Limitations of the available information

The record has no title, no EPSS score, no SSVC data and no CVSS score from other providers. It does not describe the vulnerable component in technical detail, and no exploitation evidence is present in the sources consulted. Patch details beyond the affected range must be checked in the vendor advisory.

Frequently asked questions

Is CVE-2026-10789 being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.

Which Autodesk Fusion versions are affected?

The record lists Autodesk Fusion versions below 2703.1.20 as affected. Check the vendor advisory to confirm the fixed build.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.