CVE-2026-4344 is a stored XSS vulnerability affecting Autodesk Fusion desktop application version 2606.0. A maliciously crafted HTML payload placed in a component name is executed when displayed in the delete confirmation dialog and clicked by a user. This can lead to arbitrary code execution or local file access within the application's process context. The vulnerability has a CVSS 3.1 score of 7.1, indicating high severity. No official fix or patch has been published, and the vulnerability is not related to a cloud service. User interaction is required to trigger the exploit.

Successful exploitation of this vulnerability can result in an attacker executing arbitrary code or reading local files with the privileges of the Autodesk Fusion application process. This can lead to compromise of the local system or unauthorized data access. The vulnerability requires user interaction (clicking the delete confirmation dialog) to trigger. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with component names in delete confirmation dialogs, especially if received from untrusted sources. Avoid clicking on unexpected or suspicious dialogs within Autodesk Fusion. Monitor Autodesk's official channels for updates and patches addressing this vulnerability.