CVE-2026-10789

{
  "id": "CVE-2026-10789",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-22T18:16:30.620",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user."
    },
    {
      "lang": "es",
      "value": "Una página web creada con fines maliciosos, cuando es visitada por un usuario con Autodesk Fusion Desktop en ejecución y la extensión MCP habilitada, puede desencadenar una vulnerabilidad en la extensión MCP que podría permitir la ejecución de código arbitrario. Un exploit exitoso podría permitir que el código se ejecute con los privilegios del usuario actual."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Autodesk",
          "product": "Fusion",
          "defaultStatus": "unaffected",
          "cpes": [
            "cpe:2.3:a:autodesk:fusion:2703.1.11:*:*:*:*:*:*:*"
          ],
          "versions": [
            {
              "version": "2703.1.11",
              "lessThan": "2703.1.20",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-22T00:00:00+00:00",
          "id": "CVE-2026-10789",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:autodesk:fusion:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "2703.1.20",
              "matchCriteriaId": "3FB8F36C-E497-438D-AF08-4EDCBD27BB4D"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe",
      "source": "[email protected]",
      "tags": [
        "Product"
      ]
    },
    {
      "url": "https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0008",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory",
        "Patch"
      ]
    }
  ]
}