CVE-2026-102637

HIGH 7.1CVE-2026-102637 · Published 27/10/2026 · updated 04/11/2026

In short

CVE-2026-102637 is a HIGH (CVSS 7.1) vulnerability.
Chance of exploitation in the next 30 days (EPSS): 0.17%, higher than 6.6% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
—	No affected product versions are listed for this vulnerability yet.

Description

A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

References

dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg
dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe
autodesk.com/trust/security-advisories/adsk-sa-2026-0019

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free