CVE-2026-10789

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10789", "assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "state": "PUBLISHED", "assignerShortName": "autodesk", "dateReserved": "2026-06-03T19:23:28.312Z", "datePublished": "2026-06-22T17:15:25.546Z", "dateUpdated": "2026-06-23T03:56:02.324Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "shortName": "autodesk", "dateUpdated": "2026-06-22T17:15:25.546Z"}, "title": "MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "affected": [{"vendor": "Autodesk", "product": "Fusion", "versions": [{"status": "affected", "version": "2703.1.11", "lessThan": "2703.1.20", "versionType": "semver"}], "defaultStatus": "unaffected", "cpes": ["cpe:2.3:a:autodesk:fusion:2703.1.11:*:*:*:*:*:*:*"]}], "descriptions": [{"lang": "en", "value": "A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user."}]}], "references": [{"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0008", "tags": ["vendor-advisory"]}, {"url": "https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe", "tags": ["patch"]}, {"url": "https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg", "tags": ["patch"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.6, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H"}}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-22T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-10789"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-23T03:56:02.324Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10789", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-22T17:25:03.531005Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-22T17:25:24.990Z"}}], "cna": {"title": "MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop", "source": {"discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-242", "descriptions": [{"lang": "en", "value": "CAPEC-242 Code Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:autodesk:fusion:2703.1.11:*:*:*:*:*:*:*"], "vendor": "Autodesk", "product": "Fusion", "versions": [{"status": "affected", "version": "2703.1.11", "lessThan": "2703.1.20", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0008", "tags": ["vendor-advisory"]}, {"url": "https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe", "tags": ["patch"]}, {"url": "https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg", "tags": ["patch"]}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.", "supportingMedia": [{"type": "text/html", "value": "A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "shortName": "autodesk", "dateUpdated": "2026-06-22T17:15:25.546Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10789", "state": "PUBLISHED", "dateUpdated": "2026-06-22T17:25:30.537Z", "dateReserved": "2026-06-03T19:23:28.312Z", "assignerOrgId": "7e40ea87-bc65-4944-9723-dd79dd760601", "datePublished": "2026-06-22T17:15:25.546Z", "assignerShortName": "autodesk"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:autodesk:fusion:2703.1.11:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Fusion", "vendor": "Autodesk", "versions": [{"lessThan": "2703.1.20", "status": "affected", "version": "2703.1.11", "versionType": "semver"}]}], "source": "psirt@autodesk.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:autodesk:fusion:*:*:*:*:*:*:*:*", "matchCriteriaId": "3FB8F36C-E497-438D-AF08-4EDCBD27BB4D", "versionEndExcluding": "2703.1.20", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user."}, {"lang": "es", "value": "Una p\u00e1gina web creada con fines maliciosos, cuando es visitada por un usuario con Autodesk Fusion Desktop en ejecuci\u00f3n y la extensi\u00f3n MCP habilitada, puede desencadenar una vulnerabilidad en la extensi\u00f3n MCP que podr\u00eda permitir la ejecuci\u00f3n de c\u00f3digo arbitrario. Un exploit exitoso podr\u00eda permitir que el c\u00f3digo se ejecute con los privilegios del usuario actual."}], "id": "CVE-2026-10789", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 6.0, "source": "psirt@autodesk.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10789", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-22T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-06-22T18:16:30.620", "references": [{"source": "psirt@autodesk.com", "tags": ["Product"], "url": "https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg"}, {"source": "psirt@autodesk.com", "tags": ["Product"], "url": "https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe"}, {"source": "psirt@autodesk.com", "tags": ["Vendor Advisory", "Patch"], "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0008"}], "sourceIdentifier": "psirt@autodesk.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "psirt@autodesk.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2703.1.11,2703.1.20)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Fusion", "source": "cna", "vendor": "Autodesk"}, "product": "fusion", "vendor": "autodesk"}], "created": "2026-06-22T18:30:15.398020+00:00", "updated": "2026-06-22T21:15:04.404368+00:00", "vendors": ["autodesk", "autodesk$PRODUCT$fusion"]}