CVE-2026-10789

MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop

9.6 Critical

A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.70%Up 0.4 points since Jun 23, 2026

What each source reports

CVE List Score used 9.6

MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop

Record: CVE-2026-10789
CVSS 3.1: 9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

EUVDEUVD-2026-38328 9.6

Record: EUVD-2026-38328
CVSS 3.1: 9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-fp83-vjxr-x824 9.6

A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and...

Record: GHSA-fp83-vjxr-x824
CVSS 3.1: 9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

NVD 9.6

Record: CVE-2026-10789
CVSS 3.1: 9.6 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-10789 is a critical vulnerability (CVSS 9.6) in Autodesk Fusion, published June 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. No source names a fixed version.