CVE-2026-10789
published 2026-06-22CVE-2026-10789: A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the…
PriorityP357critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
0.38%
30.6th percentile
A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| autodesk | fusion | < 2703.1.20 | 2703.1.20 |
| autodesk | fusion | >= 2703.1.11 < 2703.1.20 | 2703.1.20 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Autodesk Fusion up to 2703.1.19 MCP Extension code injection
vuldb·2026-06-22·CVSS 9.6
CVE-2026-10789 [CRITICAL] Autodesk Fusion up to 2703.1.19 MCP Extension code injection
A vulnerability described as critical has been identified in Autodesk Fusion up to 2703.1.19. Impacted is an unknown function of the component MCP Extension. The manipulation results in code injection.
This vulnerability is reported as CVE-2026-10789. The attack can be launched remotely. No exploit exists.
Upgrading the affected component is recommended.
GHSA
A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary co
ghsa_unreviewed·2026-06-22
CVE-2026-10789 [CRITICAL] CWE-94 A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary co
A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-22
Published