CVE-2026-10789: MCP Extension Code Injection Vulnerability in Autodesk Fusion Desktop

Synopsis

A code injection vulnerability in the MCP extension for Autodesk Fusion Desktop allows a remote attacker to execute arbitrary code on a victim's machine by tricking the user into visiting a maliciously crafted webpage. The attack requires no authentication and reaches the target over the network, but the user must visit the attacker-controlled page while Autodesk Fusion is running with the MCP extension enabled. Successful exploitation gives the attacker full code execution under the privileges of the logged-in user, enabling data theft, file tampering, and further system compromise. A patched-image rebuild at version 2703.1.20 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker delivers the malicious payload over the network by luring the victim to a remote webpage, so the target host must be reachable from or capable of browsing the open internet.

• AuthenticationNot required

  No account, credential, or session token is required; any unauthenticated party who can serve a webpage to the victim can attempt the exploit.

• Victim interactionRequired

  The victim must visit a maliciously crafted webpage in a browser session while Autodesk Fusion Desktop is running with the MCP extension enabled, making this a social-engineering-dependent attack.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• The attacker executes arbitrary code in the context of the logged-in user, gaining full control over any process that user can spawn.
• Confidential files, credentials, and application data accessible to the current user account are exposed to exfiltration.
• The attacker can write, modify, or delete files and persistent application state on the host, including project files managed by Autodesk Fusion.
• Because the CVSS scope is Changed, the exploit can affect resources outside the Fusion process itself, such as other applications or OS-level configurations the user has access to.