CVE-2026-0533 is a stored XSS vulnerability in Autodesk Fusion (version 2603.0) where a malicious HTML payload embedded in a design name is executed when shown in the delete confirmation dialog and clicked by a user. This can lead to arbitrary code execution or local file access within the context of the Fusion desktop application process. The vulnerability has a CVSS 3.1 base score of 8.1, reflecting high impact on confidentiality and integrity with no required privileges but user interaction needed.

Successful exploitation can result in an attacker executing arbitrary code or reading local files with the privileges of the Autodesk Fusion application process. This compromises the confidentiality and integrity of the affected system. Availability impact is not indicated. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with design names, especially those received from untrusted sources. Avoid clicking delete confirmation dialogs with suspicious design names. Monitor Autodesk's official channels for updates and patches addressing this vulnerability.