CVE-2026-0533: Stored XSS in Fusion desktop when attempting to delete a file
A maliciously crafted HTML payload in a design name, when displayed during the delete confirmation dialog and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0533?
CVE-2026-0533 is classified as a stored Cross-site Scripting (XSS) vulnerability, which can have a significant impact on user security.
How do I fix CVE-2026-0533?
To fix CVE-2026-0533, users should update to the latest version of Autodesk Fusion that includes security patches addressing this vulnerability.
Who is affected by CVE-2026-0533?
CVE-2026-0533 affects users of Autodesk Fusion desktop applications that allow the deletion of files with maliciously crafted design names.
What are the potential impacts of CVE-2026-0533?
The potential impacts of CVE-2026-0533 include unauthorized access to user data and the possibility of executing malicious scripts within the application.
When was CVE-2026-0533 discovered?
CVE-2026-0533 was first reported in 2026, highlighting a timely concern regarding the security of Autodesk Fusion.