Gespeicherte Cross-Site Scripting (XSS) Schwachstelle im Assembly Variant Name

Successful exploitation of CVE-2026-4369 allows an attacker to inject malicious scripts into the Autodesk Fusion application. These scripts could be used to steal sensitive information stored locally on the user's machine, such as credentials or configuration files. More critically, the attacker could potentially execute arbitrary code with the same privileges as the user running Fusion, enabling lateral movement within the network or further compromise of the system. While the vulnerability requires user interaction (clicking the confirmation dialog), the social engineering potential is significant, particularly in environments where users are accustomed to deleting files regularly.

Users of Autodesk Fusion who are actively working with assembly variants and relying on the delete confirmation dialog are at risk. This includes engineers, designers, and project managers who frequently manage and delete project assets within the application. Shared hosting environments where multiple users access the same Fusion installation may amplify the risk.

• windows / supply-chain:

Get-WinEvent -LogName Application -FilterXPath "/Event[System[Provider[@Name='Microsoft-Windows-PowerShell'] and (EventID=4688)] and EventData[Data[@Name='Command Line'] and contains(., 'Fusion.exe')]]"

• windows / supply-chain:

Get-Process -Name Fusion | Select-Object -ExpandProperty Path

• generic web: Inspect the delete confirmation dialog for unexpected HTML or JavaScript code.

1. 2026-04-14Disclosure

   disclosure

1. Reserviert2026-03-18
2. Veröffentlicht2026-04-14
3. Geändert2026-04-15
4. EPSS aktualisiert2026-04-22

The primary mitigation for CVE-2026-4369 is to upgrade Autodesk Fusion to version 2702.1.47 or later, which contains the fix. If immediate upgrading is not possible, consider implementing stricter input validation on assembly variant names to prevent the injection of malicious HTML. While a direct workaround is not available, monitoring user activity and educating users about the risks of clicking suspicious confirmation dialogs can help reduce the attack surface. After upgrading, confirm the fix by attempting to trigger the vulnerability with a known malicious payload and verifying that it is no longer exploitable.