CVE-2026-0534 is a stored Cross-Site Scripting (CWE-79) vulnerability affecting Autodesk Fusion desktop application version 2603.0. A malicious actor can embed a crafted HTML payload in a part’s attribute, which when clicked by a user, triggers script execution in the context of the application process. This vulnerability allows reading local files or executing arbitrary code, posing a high impact on confidentiality and integrity. The CVSS v3.1 base score is 8.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality and integrity. No patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation can lead to arbitrary code execution or unauthorized local file access within the context of the Autodesk Fusion process, compromising confidentiality and integrity of user data. The vulnerability requires user interaction (clicking the malicious payload) and can be triggered remotely via network vectors. There is no indication of availability or integrity impact beyond code execution and file reading. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid opening or interacting with untrusted parts or data attributes within Autodesk Fusion version 2603.0. Monitor Autodesk’s official channels for updates or patches addressing this vulnerability.