CVE-2026-10789

Publié : 22 juin 2026

Modifié : 22 juin 2026

Score CVSS

9.6

CRITICAL

Description détaillée

A maliciously crafted webpage, when visited by a user with Autodesk Fusion Desktop running and the MCP extension enabled, can trigger a vulnerability in the MCP extension that could allow arbitrary code execution. A successful exploit may allow code to execute with the privileges of the current user.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Références et Patchs

https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.dmg https://dl.appstreaming.autodesk.com/production/installers/Fusion%20Client%20Downloader.exe https://www.autodesk.com/trust/security-advisories/adsk-sa-2026-0008

Dernières Vulnérabilités

CVE-2026-48931

A flaw in Node.js HTTP Agent can cause a client to accept as valid a response that is send before the client has sent the request. This vulnerability affects all supported release lines: **Node.js 22**, **Node.js 24**, and **Node.js 26**.

VOIR DÉTAILS

CVE-2026-44274

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain an Improper Link Resolution Before File Access vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access.

VOIR DÉTAILS

CVE-2026-44273

Dell Wyse Management Suite (WMS), versions prior to WMS 2605, contain a Use of Default Credentials vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information Disclosure.

VOIR DÉTAILS