CVE-2026-113775

highpriority · track · 31

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

— EPSS

CVSS 7.8 · high

Is it mine?

0 products

Check your exposure

Who says so?

— sources

A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk Fusion API, can trigger an Exposed Dangerous Function vulnerability in the Autodesk Fusion desktop application. A malicious actor may leverage this vulnerability to execute arbitrary code in the context of the current process.

cvss

Technical severity, 0–10. One row per scoring source.

7.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hprimary · psirt@autodesk.comexploitability 1.8 · impact 5.9

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-749USprimary

affected products

Products and version ranges known to be affected.

No affected products recorded.

sources

Which sources assert this record, and when.

NVD CVE.org MITRE

published 2026-10-27modified 2026-10-27

related (271)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2023-21529US	—OT critical	59.3% (99th)	KEV	2023-02-14
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2021-38000US	medium6.1OT critical	4.95% (92nd)	KEV	2021-11-23
Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 95.0.4638.69 allowed a remote attacker to arbitrarily browser to a malicious URL via a cr…
CVE-2018-19322US	high7.8OT critical	1.82% (79th)	KEV	2018-12-21
The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose…
CVE-2014-3120US	high8.1OT critical	88.6% (100th)	KEV	2014-07-28
The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source pa…
CVE-2010-1428US	high7.5OT critical	52.7% (99th)	KEV	2010-04-28
The Web Console (aka web-console) in JBossAs in Red Hat JBoss Enterprise Application Platform (aka JBoss EAP or JBEAP) 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 performs acce…

+266 more

references (3) nvd

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan