Fusion
Vendor:
First CVE: Oct 7, 2022 · Active for 3 years
13
Total CVEs
More Total CVEs than 91% of tracked products
4.3
Avg CVEs / Year
Higher CVE frequency than 86% of tracked products
7.9
Avg CVSS
Higher Avg CVSS than 68% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Fusion over time
Volume of CVEsAvg CVSS Base Score
First CVE
Oct 7, 2022
3 years ago
Most Recent CVE
Jun 22, 2026
32 days ago
CVE Severity & Scoring
Fusion13 CVEs
92%
All CVEs352,294 CVEs
45%
40%
11%
HighCritical
Attack Vector
Local8 (61.5%)
Network5 (38.5%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low13 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None0 (0.0%)
Unknown0 (0.0%)
Required13 (100.0%)
Privileges Required
Low1 (7.7%)
High0 (0.0%)
None12 (92.3%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2026-10789CRITICAL A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that coul | Jun 22, 2026 | 9.6 | 39 | NO | NO |
CVE-2026-0533HIGH A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vul | Jan 22, 2026 | 8.1 | 30 | NO | NO |
CVE-2026-0535HIGH A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion | Jan 22, 2026 | 8.1 | 29 | NO | NO |
CVE-2026-0534HIGH A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop | Jan 22, 2026 | 8.1 | 29 | NO | NO |
CVE-2025-10244HIGH A maliciously crafted HTML payload, when rendered by the Autodesk Fusion desktop application, can trigger a Stored Cross-site Scripting (XSS) vulnerability. A malicious actor may l | Sep 23, 2025 | 8.7 | 29 | NO | NO |
CVE-2021-40164HIGH A heap-based buffer overflow could occur while parsing TIFF, PICT, TGA, or RLC files. This vulnerability may be exploited to execute arbitrary code. | Oct 7, 2022 | 7.8 | 26 | NO | NO |
CVE-2021-40163HIGH A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through Autodesk Image Processing component. | Oct 7, 2022 | 7.8 | 26 | NO | NO |
CVE-2021-40166HIGH A maliciously crafted PNG file in Autodesk Image Processing component may be used to attempt to free an object that has already been freed while parsing them. This vulnerability ma | Oct 7, 2022 | 7.8 | 25 | NO | NO |
CVE-2021-40165HIGH A maliciously crafted TIFF, PICT, TGA, or RLC file in Autodesk Image Processing component may be used to write beyond the allocated buffer while parsing TIFF, PICT, TGA, or RLC fil | Oct 7, 2022 | 7.8 | 25 | NO | NO |
CVE-2021-40162HIGH A maliciously crafted TIF, PICT, TGA, or RLC files in Autodesk Image Processing component may be forced to read beyond allocated boundaries when parsing the TIFF, PICT, TGA, or RLC | Oct 7, 2022 | 7.8 | 25 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (13 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (13 CVEs).
Media Mentions
Signals from CVEs in this product scope (13 CVEs).
Top CNAs Publishing CVEs For Fusion
Top CWEs
Versions
No cataloged versions.