This vulnerability (CVE-2026-10789) involves improper control of code generation (CWE-94) in the MCP extension of Autodesk Fusion Desktop. When a user visits a crafted webpage while running Autodesk Fusion Desktop version 2703.1.11 with the MCP extension enabled, the vulnerability can be triggered to execute arbitrary code under the privileges of the current user. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high impact on confidentiality, integrity, and availability. No patch or official remediation level has been published by Autodesk as of the provided data.

Successful exploitation allows arbitrary code execution with the privileges of the current user, potentially leading to full compromise of the user's environment, including confidentiality breaches, data integrity loss, and denial of service. The vulnerability is triggered remotely via a malicious webpage, requiring user interaction (visiting the webpage).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the MCP extension or avoid visiting untrusted webpages while running Autodesk Fusion Desktop version 2703.1.11 with the MCP extension enabled.