CVE-2026-15102
7.5HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-319
Impact
Attackers with local access can intercept sensitive data to gain unauthorized access to Autodesk services. Exploitation requires existing local credentials and user interaction under specific timing conditions.
Root cause
The ADP Desktop SDK transmits sensitive information across the network in cleartext without encryption.
Affected systems
ADP Desktop SDK (specific versions not listed — check the vendor advisory).
CVSS v3.1 · CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Fix & remediation
Upgrade to the patched ADP Desktop SDK or updated Autodesk Access client specified in ADSK-SA-2026-0017; as an interim mitigation, restrict local workstation access and monitor outbound unencrypted traffic from Autodesk processes.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
ADP Desktop SDK contains a vulnerability where sensitive information is transmitted in clear text. Exploitation of this vulnerability can lead to unauthorized access to Autodesk services.