BORIS for Autodesk Inventor - Secure Your CAD Designs

Autodesk ADP Desktop SDK Advisory ADSK-SA-2026-0017: What Inventor Teams Should Do | Autodesk Inventor | Register and Certify Ownership of CAD design

2026-10-15 15:27 News
Autodesk published a high-severity security advisory on 14 October 2026 for the ADP Desktop SDK, a shared analytics component that runs inside Autodesk desktop applications. Advisory ADSK-SA-2026-0017 (CVE-2026-15102) says the component sends sensitive information in clear text, and that exploiting this can lead to unauthorized access to Autodesk services. The fix is version 7.0.4 or later, delivered through Autodesk Access or the Accounts Portal.
This is not a bug in an Inventor part or assembly file, and you cannot trigger it by opening a model. It sits in the plumbing that comes with Autodesk desktop software. According to Autodesk support, the ADP Desktop SDK belongs to the Autodesk Analytics Program and is used for data collection and analytics within Autodesk applications. Autodesk's advisory does not name individual end products, so CAD managers should not assume Inventor workstations are out of scope.
For Inventor teams the practical question is simple: is every workstation that signs in to Autodesk running a fixed version, and who else could get local access to those machines? Below we set out exactly what Autodesk published, what it did not say, how this differs from last month's Fusion add-in advisory, and a short patch plan for Inventor and Vault environments.
TL;DR: ADSK-SA-2026-0017 in one paragraph

On 14 October 2026 Autodesk rated a flaw in the ADP Desktop SDK as High (CVSS 3.1 score 7.5). The component transmits sensitive information in clear text, and exploitation can lead to unauthorized access to Autodesk services. An attacker needs local access to the machine, and the CVE record also lists high attack complexity, low privileges and user interaction. Versions 5.5.54, 6.4.34, 7.0.3 and earlier are affected; Autodesk names 7.0.4 and later as mitigated. Update through Autodesk Access or the Accounts Portal. Autodesk does not say which products ship which SDK version, what the sensitive information is, or that the flaw has been exploited. Treat every Autodesk desktop install, including Inventor, as in scope until you have checked it.

What did Autodesk announce on 14 October?

The advisory is titled "Cleartext Transmission of Sensitive Information Vulnerability in ADP Desktop SDK". It has the Autodesk ID ADSK-SA-2026-0017 and a single CVE, CVE-2026-15102. Autodesk rates it High. The summary says exploitation can lead to unauthorized access to Autodesk services and that it requires local machine access. You can read it in full in Autodesk's security advisory ADSK-SA-2026-0017.
The affected item is the ADP Desktop SDK in versions 5.5.54, 6.4.34, 7.0.3 and earlier. Autodesk lists 7.0.4 and later as mitigated, with Autodesk Access or the Accounts Portal as the update source, and adds the note that the product list is subject to change. The issue was reported by security researcher Bruno Lowczy, whom Autodesk credits in the advisory.
The public CVE record, published the same day, adds some technical detail. It classifies the weakness as CWE-319, cleartext transmission of sensitive information, with interception as the attack pattern. It marks versions from 5.0.0 before 5.5.55, from 6.0.0 before 6.4.35 and from 7.0.0 before 7.0.4 as affected, which suggests fixed builds also exist in the 5.x and 6.x lines. The advisory itself only names 7.0.4 and later, so that is the version to aim for.

What is the ADP Desktop SDK, and is Inventor affected?

Most Inventor users have never heard of this component, which is the point. Autodesk support describes the ADP Desktop SDK as related to the Autodesk Analytics Program and used for data collection and analytics within Autodesk applications. Its client service shows up in Autodesk's own troubleshooting pages, for example when the message "Autodesk Analytics Client Service has stopped working" appears while opening or closing an Autodesk product.
The advisory names the component, not the products that include it. We have not found an Autodesk statement that lists Inventor, Vault or Fusion by name for this CVE, and we do not claim one. What we can say is that the component is shared across Autodesk desktop applications and that Inventor runs alongside the same Autodesk Access and Autodesk Account sign-in setup as other Autodesk tools. The safe working assumption for a CAD manager is that any workstation with Autodesk desktop software is in scope until Autodesk Access shows it is up to date. If you are new to how Inventor is installed and licensed, our overview of Autodesk Inventor software is a good starting point.

How serious is it for an Inventor workstation?

The severity is High, but the conditions matter. The CVE record scores it 7.5 with a local attack vector, high attack complexity, low privileges required and user interaction required. In plain terms, a remote attacker on the internet cannot use this alone. Someone needs a foothold on the machine first, and the attack is not trivial.
Those conditions are not rare in engineering offices, though. Shared workstations on the shop floor, training rooms, remote desktop servers that several engineers sign in to, and laptops that travel to suppliers all give more people local access than a typical office PC. Malware that already runs under a user's account also counts as local access. Our guide to remote CAD team security protocols covers the setups where this tends to go wrong.
The stakes are an Autodesk account rather than a single file. Autodesk accounts give access to licences and, depending on your setup, to cloud services that hold design data. Autodesk does not say which services or which data would be exposed, so we will not speculate. But an account that can reach shared projects is worth more to an attacker than one drawing, which is why tracking who accesses your CAD files and role-based access control for CAD matter alongside patching.

How does it compare with recent Autodesk advisories?

This is the second Autodesk advisory in five weeks that concerns account access rather than a malicious drawing. On 10 September 2026 Autodesk published ADSK-SA-2026-0016 for Fusion Desktop: a maliciously crafted add-in could change Fusion's persistent network proxy settings without telling the user, which could redirect authenticated Fusion traffic through a proxy controlled by an attacker. Earlier advisories focused on crafted files, which our sister site CADChain covered in its report on malicious CAD files and Autodesk parsing flaws.
ADSK-SA-2026-0017ADSK-SA-2026-0016
Published14 October 202610 September 2026
ComponentADP Desktop SDK (shared analytics component)Autodesk Fusion Desktop
IssueSensitive information sent in clear textCrafted add-in can change proxy settings without consent
Possible resultUnauthorized access to Autodesk servicesAuthenticated Fusion traffic routed through an attacker's proxy
Severity (CVSS 3.1)High, 7.5High, 8.6
What the attacker needsLocal machine access, plus user interactionThe user installs and runs a malicious add-in
FixADP Desktop SDK 7.0.4 or later via Autodesk Access or Accounts PortalUpdate Fusion Desktop as described in the advisory
The pattern is worth noting. Both issues turn the trust between a desktop application and Autodesk's cloud into the target. For Inventor shops that also use Fusion, add-ins and cloud sign-in, the attack surface now includes the components around the CAD tool, not just the files it opens. Our article on plugin security architecture for Inventor and the guide to Inventor plugins for workflow automation explain how to vet what runs inside your CAD session.
Patch the workstation, and protect the design record too.

BORIS for Autodesk Inventor registers your CAD files with a blockchain timestamp from inside Inventor, so you hold an independent, dated certificate of ownership for each version, whatever happens to an account.

👉 Get BORIS for Autodesk Inventor

What should Inventor teams do now?

  1. List every machine in scope. Include engineering desktops, laptops, shop-floor and training PCs, and remote desktop or virtual workstations where Inventor, Vault client or other Autodesk desktop software is installed.
  2. Update through Autodesk Access. Autodesk's recommendation is to install the latest mitigated versions via Autodesk Access or the Accounts Portal. The target for the ADP Desktop SDK is 7.0.4 or later. If your company deploys Autodesk software centrally, ask IT to confirm the component version after the update.
  3. Start with shared machines. The flaw needs local access, so prioritise computers that several people use, remote desktop servers, and laptops that leave the building.
  4. Tighten local access. Review who has local admin rights on CAD workstations, remove old local accounts, and make sure screens lock when engineers step away.
  5. Check your Autodesk Account. Review the users assigned to your team and remove anyone who has left. If you have any reason to suspect misuse on a shared machine, reset the affected users' passwords.
  6. Keep proof that does not depend on an account. Accounts can be compromised and cloud projects can change. Register key design versions with a blockchain timestamp so you can show what existed and when, independent of any single login.
Data collection settings are a separate question. Autodesk lets users and admins enable or disable the Desktop Analytics Program, but Autodesk's advisory names the update, not an opt-out, as the fix. Treat the setting as a privacy choice and patch either way. For a wider checklist, see our guides on securing sensitive CAD data in cloud storage and CAD file security best practices for manufacturing companies.

What did Autodesk not say?

It is just as important to be clear about the gaps. The advisory does not say:
  • Which products are affected. It names the ADP Desktop SDK component and its versions, not Inventor, Vault, Fusion or AutoCAD.
  • What the sensitive information is. It says information is sent in clear text and that this can lead to unauthorized access to Autodesk services. It does not describe the data.
  • Whether it has been exploited. The advisory does not mention any attacks using this flaw, and we have found no reports of exploitation.
If Autodesk revises the advisory, the revision history at the bottom of the page will show it. Until then, the safe reading is: update everything, start with shared machines, and do not wait for a product-by-product list.

How does this fit the wider picture?

This week's news across our sites shares one theme: the most valuable thing in a design business is access, whether to accounts, to files or to the people who hold both.
Closer to home, Autodesk is moving Inventor toward cloud-connected AI workflows. Our report on Inventor AI after Autodesk University 2026 explains why account and data questions will only grow. And our recent piece on 3D model files as trade secrets shows how dated, attributable records decide disputes. The CADChain team also explains how CAD data protection works across tools.

Conclusion

ADSK-SA-2026-0017 is a high-severity advisory with limited public detail. A shared Autodesk analytics component sends sensitive information in clear text, someone with local access could use that to reach Autodesk services, and the fix is ADP Desktop SDK 7.0.4 or later through Autodesk Access or the Accounts Portal. Autodesk does not list products, data or attacks, so Inventor teams should patch every Autodesk desktop install, starting with shared and remote machines, and tidy up local access and Autodesk Account users. Patching protects the account. A dated, independent record protects the designs. Our complete guide to CAD data protection and our article on the consequences of CAD file leaks show why both matter.
Keep proof of your designs that no login can change.

BORIS for Autodesk Inventor gives every registered file a blockchain timestamp and a certificate of ownership, directly inside Inventor.

👉 See how BORIS for Autodesk Inventor works

FAQ: Autodesk advisory ADSK-SA-2026-0017

What is ADSK-SA-2026-0017?

It is an Autodesk security advisory published on 14 October 2026 for the ADP Desktop SDK. It covers CVE-2026-15102, a flaw where sensitive information is transmitted in clear text. Autodesk rates it High and says exploitation can lead to unauthorized access to Autodesk services.

What is the ADP Desktop SDK?

Autodesk support describes it as a component related to the Autodesk Analytics Program, used for data collection and analytics within Autodesk applications. It is not a product you buy or open directly.

Is Autodesk Inventor affected?

The advisory names the ADP Desktop SDK component, not individual products, and does not mention Inventor. Because the component is shared across Autodesk desktop applications, treat Inventor workstations as in scope until Autodesk Access shows them up to date.

Which versions are affected and which are fixed?

Autodesk lists versions 5.5.54, 6.4.34, 7.0.3 and earlier as impacted and 7.0.4 and later as mitigated. The CVE record marks 5.x before 5.5.55, 6.x before 6.4.35 and 7.x before 7.0.4 as affected.

How do I install the fix?

Autodesk recommends installing the latest mitigated versions through Autodesk Access or the Accounts Portal. Companies that deploy Autodesk software centrally should have IT confirm the component version after updating.

Can someone exploit it over the internet?

Not on its own. Autodesk says exploitation requires local machine access, and the CVE record lists high attack complexity, low privileges and user interaction. Shared PCs, remote desktop servers and malware already on a machine are the realistic risks.

Does turning off Desktop Analytics fix it?

Autodesk's advisory names the update as the fix, not an opt-out. You can choose your analytics setting for privacy reasons, but you should still install the update.

How does BORIS help?

BORIS for Autodesk Inventor registers CAD files with a blockchain timestamp from inside Inventor. You get a dated certificate for each registered version that does not depend on any account or server, which helps prove what you designed and when.