Detections
Analytics

macOS Autodesk Fusion 360 <= 2705.1.30 Multiple Vulnerabilities (adsk-sa-2026-0019)

high Nessus Plugin ID 376250

Synopsis

Autodesk Fusion 360 installed on the remote macOS host is affected by multiple vulnerabilities.

Description

The version of Autodesk Fusion 360 installed on the remote macOS or Mac OS X host is less than or equal to 2705.1.30.
It is, therefore, affected by multiple vulnerabilities:

 - A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to execute arbitrary code in the context of the current process. (CVE-2026-113775)

 - A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. (CVE-2026-102636)

 - A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can trigger a Reflected Cross-site Scripting (XSS) vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to read local files or execute arbitrary code in the context of the current process. (CVE-2026-102637)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Autodesk Fusion 360 version 2706.1.14 or later.

See Also

https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0019

Plugin Details

Severity: High

ID: 376250

File Name: macos_autodesk_fusion_360_adsk-sa-2026-0019.nasl

Version: 1.1

Type: Local

Agent: macosx

Published: 11/5/2026

Updated: 11/5/2026

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 58.57

CVSS v2

Risk Factor: High

Base Score: 7.2

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-113775

CVSS v3

Risk Factor: High

Base Score: 7.8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:autodesk:fusion_360

Required KB Items: Host/local_checks_enabled, Host/MacOSX/Version, installed_sw/Autodesk Fusion 360

Patch Publication Date: 10/27/2026

Vulnerability Publication Date: 10/27/2026

Reference Information

CVE: CVE-2026-102636, CVE-2026-102637, CVE-2026-102638, CVE-2026-113775