CVE-2026-10789— MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop
Quick assessment
Affected
Autodesk Fusion
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Autodesk fusion是美国Autodesk公司的一款三维设计建模软件。 Autodesk fusion 2703.1.11版本至2703.1.20之前版本存在代码注入漏洞，该漏洞源于MCP扩展存在代码注入漏洞，可能导致恶意制作的网页触发任意代码执行，成功利用可能允许代码以当前用户权限执行。
Possible ATT&CK Techniques 2 AI
T1203 · Exploitation for Client Execution T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-10789
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop
Source: CVE Program / CVE List V5
Vulnerability Description
A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Autodesk fusion 代码注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Autodesk fusion是美国Autodesk公司的一款三维设计建模软件。 Autodesk fusion 2703.1.11版本至2703.1.20之前版本存在代码注入漏洞，该漏洞源于MCP扩展存在代码注入漏洞，可能导致恶意制作的网页触发任意代码执行，成功利用可能允许代码以当前用户权限执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-10789
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-10789
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-10789 (1)
-
🔗 Security Advisories | Autodesk | adsk-sa-2026-0008 vendor-advisory
Other References for CVE-2026-10789 (2)
IV. Related Vulnerabilities
Same product: Fusion
-
CVE-2026-85217
Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion De -
CVE-2026-41702
TOCTOU local privilege escalation vulnerability -
CVE-2026-4344
Stored Cross-Site Scripting (XSS) Vulnerability in Assembly -
CVE-2026-4345
Stored Cross-Site Scripting (XSS) Vulnerability in Design Na -
CVE-2026-4369
Stored Cross-Site Scripting (XSS) Vulnerability in Assembly
Same vendor: Autodesk
-
CVE-2026-85217
Man-in-the-Middle (MITM) Vulnerability in Autodesk Fusion De -
CVE-2026-14255
IFC File Parsing Uncontrolled Recursion in Certain Autodesk -
CVE-2026-19568
SVG File Parsing Memory Corruption Vulnerability in Autodesk -
CVE-2026-7455
FLT File Parsing Out-of-Bounds Write Vulnerability in Autode -
CVE-2026-16783
ABC File Parsing Out-of-Bounds Write Vulnerability in Autode
Same weakness: CWE-94
-
CVE-2026-10026
CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remo -
CVE-2026-55251
NetBox Device Type Library: Arbitrary Code Execution on CI R -
CVE-2026-92966
Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitr -
CVE-2026-102130
Kiteworks Email Protection Gateway Remote Code Execution -
CVE-2026-102131
Kiteworks Email Protection Gateway Improper Handling of Case
V. Comments for CVE-2026-10789
No comments yet