CVE-2026-10789: Autodesk Fusion MCP Extension RCE Flaw

CVE-2026-10789 Overview

CVE-2026-10789 is a code injection vulnerability [CWE-94] in the Model Context Protocol (MCP) extension of Autodesk Fusion Desktop. A maliciously crafted webpage, when visited by a user running Autodesk Fusion Desktop with the MCP extension enabled, can trigger arbitrary code execution. Successful exploitation runs code with the privileges of the current user. The flaw requires user interaction but no authentication, and exploitation occurs over the network through a victim's browser session.

Critical Impact
A drive-by web visit can lead to arbitrary code execution in the context of the logged-in user, enabling full compromise of the workstation.

Affected Products

Autodesk Fusion (Desktop) with the MCP extension enabled
Autodesk Fusion Client (Windows .exe installer)
Autodesk Fusion Client (macOS .dmg installer)

Discovery Timeline

2026-06-22 - CVE-2026-10789 published to the National Vulnerability Database (NVD)
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-10789

Vulnerability Analysis

The vulnerability resides in the Autodesk Fusion MCP (Model Context Protocol) extension, which exposes a locally accessible service used to coordinate context between Fusion Desktop and external clients. The MCP extension fails to adequately validate or restrict input received from untrusted web origins. As a result, a malicious webpage rendered in any browser on the same host can craft requests that the MCP extension interprets as executable commands or code. The flaw is classified under [CWE-94] Improper Control of Generation of Code ("Code Injection").

Because the MCP extension runs alongside Fusion Desktop in the user's session, any injected code executes with the same privileges as the logged-in user. This grants attackers access to local files, network resources reachable by the user, and persistence mechanisms available in the user profile.

Root Cause

The root cause is improper neutralization of attacker-controlled input in the MCP extension's request handler. The extension trusts data delivered through web-originated channels and incorporates that data into a code or command execution path without sufficient origin checks, input validation, or sandboxing. This pattern is a hallmark of [CWE-94] code injection flaws in locally bound application services.

Attack Vector

Exploitation follows a classic drive-by pattern. The victim launches Autodesk Fusion Desktop with the MCP extension enabled, then visits an attacker-controlled or compromised webpage. The page issues crafted requests to the MCP listener bound on the local host. The MCP extension processes the request and executes attacker-supplied code in the user's context. No credentials are required, but the user must interact with the malicious page. The full exploitation chain typically involves social engineering to lure the user to the attacker's URL, followed by silent execution on the endpoint.

Detection Methods for CVE-2026-10789

Indicators of Compromise

Unexpected child processes spawned by Autodesk Fusion or its MCP extension executable, particularly script interpreters such as cmd.exe, powershell.exe, bash, or osascript.
Outbound network connections initiated by Fusion Desktop or the MCP extension to non-Autodesk infrastructure.
Browser history or proxy logs showing visits to unfamiliar domains immediately preceding suspicious endpoint activity.
New persistence artifacts in user-writable locations such as %APPDATA%, ~/Library/LaunchAgents, or scheduled tasks created shortly after Fusion was running.

Detection Strategies

Monitor process lineage for Fusion Desktop and the MCP extension binary, alerting on any non-standard child process creation.
Inspect localhost traffic for unusual HTTP or WebSocket activity directed at the MCP listener port from browser processes.
Correlate browser sessions with subsequent script-host or shell execution within a short time window to identify drive-by chains.

Monitoring Recommendations

Enable command-line auditing on Windows endpoints and execve auditing on macOS to capture argument data for processes launched by Fusion.
Track file writes to user persistence locations originating from Fusion or its child processes.
Alert on Fusion or MCP-related processes reaching out to non-Autodesk domains, especially over non-standard ports.

How to Mitigate CVE-2026-10789

Immediate Actions Required

Disable the MCP extension in Autodesk Fusion Desktop until a patched build is installed.
Apply the updated Autodesk Fusion Client by downloading the current installer from Autodesk's distribution endpoints and following the guidance in Autodesk Security Advisory ADSK-SA-2026-0008.
Restrict workstation browsing on machines that run Fusion with MCP enabled, and apply web filtering to block known malicious domains.

Patch Information

Autodesk has published remediation guidance in Autodesk Security Advisory ADSK-SA-2026-0008. Updated clients are available from Autodesk's distribution endpoints for both Windows (Fusion Client EXE) and macOS (Fusion Client DMG). Administrators should redeploy Fusion through their standard software distribution channels and verify the MCP extension version after upgrade.

Workarounds

Turn off the MCP extension in Fusion settings on all endpoints that do not require it.
Block outbound access to attacker infrastructure using DNS filtering, and segment engineering workstations from general-purpose browsing where feasible.
Enforce least-privilege user accounts so that code executing in the user context has minimal access to sensitive resources.

bash

# Example: verify whether the MCP extension listener is active on a workstation
# Windows (PowerShell)
Get-NetTCPConnection -State Listen | Where-Object { $_.OwningProcess -in (Get-Process -Name *Fusion* -ErrorAction SilentlyContinue).Id }

# macOS / Linux
lsof -iTCP -sTCP:LISTEN -P | grep -i fusion