CVE-2026-10789

9.6 Critique

Publiée le 22/06/2026 à 20:16 · Modifiée le 24/06/2026 à 17:30 · Analysée par le NVD · Source : psirt@autodesk.com

Description

A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.

Traduire en français

Produits concernés

Autodesk Fusion

Scores CVSS

Version	Score	Source	Vecteur
3.1	9.6 Critique	psirt@autodesk.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-94

Références

https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg Product
https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe Product
https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0008 Vendor AdvisoryPatch

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories