CVE-2026-0534 HIGH

CVE-2026-0534: Stored XSS in the value of a part attribute

Vendor Autodesk

Product Fusion

Weakness CWE-79 · XSS

Published January 22, 2026

Last update June 3, 2026

View on NVD All CVEs

CVSS base score

8.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

Key dates

02Disclosure timeline

January 22, 2026 CVE published

June 3, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-0534 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/79.html

Related vulnerabilities

04Related CVE

CVE-2023-32801 WordPress WooCommerce Composite Products Plugin <= 8.7.5 is vulnerable to Cross Site Scripting (XSS) CVE-2024-35751 WordPress Woody code snippets plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability CVE-2024-56231 WordPress SaasPricing plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability CVE-2024-13672 Mini Course Generator | Embed mini-courses and interactive content <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2023-41867 WordPress AcyMailing SMTP Newsletter Plugin <= 8.6.2 is vulnerable to Cross Site Scripting (XSS)