CVE-2026-4344: XSS in Autodesk Fusion 2606.0–2702.1.47

An attacker could exploit this XSS vulnerability to execute arbitrary JavaScript code within the context of the user's Autodesk Fusion session. This could allow them to steal sensitive information, such as user credentials or project data, or even manipulate the application's functionality. The attacker could potentially read local files accessible to the Fusion process, expanding the scope of potential data compromise. While the immediate blast radius is limited to users interacting with the delete confirmation dialog, successful exploitation could lead to broader system compromise if the user has elevated privileges or access to sensitive resources. This vulnerability highlights the importance of proper input validation and output encoding to prevent XSS attacks.

1. Reserved2026-03-17
2. Published2026-04-14
3. Modified2026-04-15
4. EPSS updated2026-04-22

The primary mitigation for CVE-2026-4344 is to upgrade to Autodesk Fusion version 2702.1.47 or later, which includes the necessary fix. If immediate upgrading is not feasible, consider implementing temporary workarounds such as restricting user access to the delete confirmation dialog or disabling the functionality entirely. Additionally, review and strengthen input validation routines within the application to prevent the injection of malicious HTML payloads. Monitor network traffic for suspicious activity related to the Fusion application, particularly requests containing unusual HTML content. After upgrading, confirm the fix by attempting to trigger the delete confirmation dialog with a known malicious payload and verifying that the script is not executed.