CVE-2026-0535: Stored XSS in Electronic Library Component Description

Q: What is the severity of CVE-2026-0535?

CVE-2026-0535 is classified as a medium severity stored cross-site scripting vulnerability.

Q: How do I fix CVE-2026-0535?

To fix CVE-2026-0535, update your Autodesk Fusion application to the latest version where the vulnerability is patched.

Q: What impact does CVE-2026-0535 have on users?

CVE-2026-0535 allows attackers to execute malicious scripts in the context of the user's session, potentially leading to data theft or account compromise.

Q: Which software is affected by CVE-2026-0535?

CVE-2026-0535 affects the Autodesk Fusion desktop application.

Q: Can CVE-2026-0535 be exploited remotely?

Yes, CVE-2026-0535 can be exploited remotely if the malicious HTML payload is clicked by an unsuspecting user.

Published Jan 22, 2026

Updated

A maliciously crafted HTML payload, stored in a component’s description and clicked by a user, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process.

Affected Software

2 affected components

Autodesk Fusion

Autodesk Fusion<2606.1.21

Remediation

Patch Available

https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0001

Event History

Jan 22, 2026

CVE Published

via MITRE·04:59 PM

Data Sourced

via MITRE·04:59 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-0535?

CVE-2026-0535 is classified as a medium severity stored cross-site scripting vulnerability.

How do I fix CVE-2026-0535?

To fix CVE-2026-0535, update your Autodesk Fusion application to the latest version where the vulnerability is patched.

What impact does CVE-2026-0535 have on users?