CVE-2026-0534: Stored XSS in the value of a part attribute

Q: What is the severity of CVE-2026-0534?

CVE-2026-0534 is typically classified as a medium severity vulnerability due to its potential for exploitation through stored XSS.

Q: How do I fix CVE-2026-0534?

To fix CVE-2026-0534, update to the latest version of Autodesk Fusion that addresses this vulnerability.

Q: What type of vulnerability is CVE-2026-0534?

CVE-2026-0534 is a Stored Cross-site Scripting (XSS) vulnerability.

Q: Who is affected by CVE-2026-0534?

CVE-2026-0534 affects users of the Autodesk Fusion desktop application.

Q: What can a malicious actor achieve with CVE-2026-0534?

A malicious actor can exploit CVE-2026-0534 to execute arbitrary scripts in the context of another user's session.

Published Jan 22, 2026

Updated

A maliciously crafted HTML payload, stored in a part’s attribute and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

Affected Software

2 affected components

Autodesk Fusion

Autodesk Fusion<2606.1.21

Remediation

Patch Available

https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0001

Event History

Jan 22, 2026

CVE Published

via MITRE·04:59 PM

Data Sourced

via MITRE·04:59 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-0534?

CVE-2026-0534 is typically classified as a medium severity vulnerability due to its potential for exploitation through stored XSS.

How do I fix CVE-2026-0534?

To fix CVE-2026-0534, update to the latest version of Autodesk Fusion that addresses this vulnerability.

What type of vulnerability is CVE-2026-0534?