CVE-2026-0533
📋 TL;DR
A stored cross-site scripting vulnerability in Autodesk Fusion allows attackers to inject malicious HTML into design names. When users view the delete confirmation dialog and interact with it, this can lead to arbitrary code execution or local file access. All users running vulnerable versions of Autodesk Fusion desktop application are affected.
💻 Affected Systems
- Autodesk Fusion
📦 What is this software?
Fusion by Autodesk
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Autodesk Fusion process, allowing attackers to read sensitive local files, execute arbitrary code with user privileges, and potentially pivot to other systems.
Likely Case
Session hijacking, credential theft, or limited file access through malicious JavaScript execution in the application context.
If Mitigated
Limited impact with proper input validation and output encoding, potentially reduced to UI manipulation without code execution.
🎯 Exploit Status
Requires social engineering to get user to interact with malicious design name in delete dialog
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version with fix referenced in ADSK-SA-2026-0001
Vendor Advisory: https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0001
Restart Required: Yes
Instructions:
1. Open Autodesk Fusion 2. Check for updates in application settings 3. Download and install latest version 4. Restart application
🔧 Temporary Workarounds
Avoid suspicious design names
allDo not open or delete designs with suspicious HTML-like names
🧯 If You Can't Patch
- Restrict user permissions to limit file access capabilities
- Implement application whitelisting to prevent unauthorized code execution
🔍 How to Verify
Check if Vulnerable:
Check if current Autodesk Fusion version matches vulnerable versions listed in vendor advisoryCheck Version:
In Autodesk Fusion: Help → About Fusion 360Verify Fix Applied:
Verify installation of patched version from vendor advisory and test with safe XSS payload📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns from Fusion process
- Multiple delete operations with unusual design names
Network Indicators:
- Outbound connections from Fusion to unexpected destinations
SIEM Query:
Process: 'Fusion.exe' AND (FileAccess: 'sensitive' OR NetworkConnection: 'suspicious')