Autodesk Fusion: Exposed dangerous function in API allows code execution
Summary
The Autodesk Fusion desktop application exposes a command (TextCommands.LoadDll) through its API that loads a dynamic library from an arbitrary path without sufficient restriction. A maliciously crafted library loaded this way can execute arbitrary code in the context of the running Fusion process. The attacker needs local access to the workstation and a user must interact with the application, so the attack is not network-facing. The CNA rates the issue 7.8 (High), while VulDB's own score is lower.
Affected
- Autodesk Fusion 2705.1.30 to before 2706.1.14 (CNA range)
- VulDB lists the range as up to 2706.1.13
- Unknown: whether older branches (below 2705.1.30) are affected
Fixed in
- Autodesk Fusion 2706.1.14 (per VulDB and the CNA range)
Workaround
- No workaround or mitigation is documented.
Exploitation
- Not listed in CISA KEV.
- No public exploit listed.
- No vendor or independent confirmation of exploitation found.
- EPSS: 0.14 % (psirt.com shows 0 % for 30 days).
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
Our recommendation
- Update Autodesk Fusion to version 2706.1.14 or later on all workstations.
- Verify the installed build, prioritising shared and administrator workstations.
- Restrict who can run Fusion and limit local access to affected machines.
- Check the vendor advisory ADSK-SA-2026-0019 for the authoritative version table, as it was not confirmed directly.
- Monitor for changes in exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Autodesk security advisory ADSK-SA-2026-0019 www.autodesk.com
- VulDB entry 427442 vuldb.com
- Strix CVE record CVE-2026-113775 www.strix.ai
- PSIRT record CVE-2026-113775 psirt.com
- ThreatInt CVE record CVE-2026-113775 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:11.
Original description (NVD)
A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to execute arbitrary code in the context of the current process.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.