- NexSysIT Editorial Team
- Updated 23 Sep 2026
- 11 min read
Autodesk Advisories: Releases, Licensing Changes and Policy Deadlines That Affect Australian Practices
We keep this list for clients. It holds the Autodesk software releases, licensing changes and Australian policy deadlines that change what a practice has to do, each with a date, a source and the thing to do about it, written for the person who has to read it in the week it lands rather than the person who writes press releases. It isn’t news. Autodesk announces a great deal that needs no response from a forty-person practice in Adelaide, and none of that is here. The handful of items a year that do need one are.
We’re NexSys’s Design Technology team, and NexSys is an Autodesk Elite Partner. Newest first. Prices are Autodesk’s Australian list, ex GST. Every date belongs to the vendor or the agency that set it, not to us, and if we’ve got one wrong the source is linked so you can check.
Through 2026: Autodesk security advisories keep landing on file-parsing flaws in Revit, AutoCAD and 3ds Max
Autodesk publishes its security advisories through the Autodesk Trust Center. Each one has a unique identifier in the form ADSK-SA-2026-0015, a severity rated from low to critical using CVSS, the list of affected products, and usually a patch or a workaround. Most also include steps for users and system administrators. The pattern through 2026 has been consistent: file-parsing flaws across several products, where a maliciously crafted file can crash the application, execute code or expose data when someone opens it. Autodesk Revit, AutoCAD-based products and 3ds Max have all carried vulnerabilities, and Revit and 3ds Max have both carried multiple vulnerabilities that need user interaction, which in plain terms means someone opening the wrong file. Other advisories this year have covered a man-in-the-middle flaw in Fusion, denial-of-service conditions in several products, and privilege escalation through the Autodesk Installer. Some advisories concern shared components used by several Autodesk products at once, so one patch can touch every seat in the office, and a few warn about threats outside Autodesk’s own code that affect the ecosystem around it.
Autodesk’s standard advice is to open files only from trusted sources, and in a design practice that advice needs translating, because opening consultants’ files is the job. What it means in practice is patching. Revit 2027 updates are cumulative, so each one includes every earlier fix, and they’re installed through Autodesk Access or downloaded from the Autodesk Account portal. An unpatched vulnerability can lead to remote code execution and data exposure, and an emergency patch in the middle of a submission week is how vulnerabilities disrupt workflows. The Essential Eight’s patch applications control asks for exactly this, and it’s what enterprise and government clients mean when they ask a contractor about vulnerability management. Check the Trust Center monthly, or have us do it and email the ones that apply to your Autodesk products and your version list. Apply critical and high advisories inside the Essential Eight’s timeframes, and keep the deployed version list current so you know which advisories apply.
May 2026: Revit 2021 and earlier lose cloud model access
Thirty days after the Revit 2027 release, Autodesk restricted Revit cloud model access to Revit 2022 and newer. Revit 2021 and earlier can no longer open or create cloud models or use cloud collaboration features, and Autodesk’s reasoning is that older versions rely on legacy systems that are increasingly incompatible with the modernised infrastructure. No additional product is required, but the active subscription has to support an eligible version.
If any project in the practice still has a 2021 or earlier model sitting in Autodesk Construction Cloud or BIM 360, upgrade it to a supported version or download it before it becomes unreachable. Nearly every practice we asked found one. It was the job that finished in 2022, was never formally closed out, and still has a defects-period query arriving every few months. The live project list won’t show it; the archive will.
7 April 2026: Autodesk Revit 2027 released
Autodesk released Revit 2027 with Autodesk Assistant in technical preview, which lets a user ask the model questions and trigger documentation and modelling actions in plain language, Forma tools brought into the Revit subscription, Issues integrated into the core product rather than an optional extension, rule-based numbering and improved tagging, Dynamo on .NET 10, and Accelerated Graphics now production-ready. Forma Carbon Insights brings embodied carbon evaluation into the model.
Don’t upgrade the office in April. Some resellers would argue with that, since a release sells upgrades, but a practice should move to a new Revit when its live projects can, which in our experience is the following financial year, and never mid-project unless a consultant on the job forces the issue. The change that bites is Dynamo on .NET 10, because it breaks add-ins that were fine for five releases. Before anyone installs 2027, go through the add-in list against it, read the release notes and the community forums for each add-in you can’t work without, and pin the version in application control so an enthusiastic graduate can’t install it on a Friday.
September 2025: Infrastructure NSW requires ISO 19650 on state projects
Infrastructure NSW’s Digitalisation and Data Policy requires information requirements and the common data environment on NSW state infrastructure projects to follow ISO 19650. The transition period for agencies is 18 months, which runs into 2027, and Transport for NSW’s contractor CDE standard, with its work in progress, shared, client shared and published states, was already in force.
A consultant on state work now has to be able to answer an EIR with a BEP and a MIDP, and to run a CDE that holds those four states with a gate between each one and a log of who moved what and when. That’s the whole requirement, and it sounds like a platform purchase. It mostly isn’t. The ISO 19650 guide covers what that means for a practice’s IT, and the short answer is that most of the cost is process rather than platform.
14 October 2025: Windows 10 support ended
Microsoft ended support for Windows 10 on 14 October 2025. Autodesk’s support for Windows 10 ended alongside it. A workstation still on Windows 10 receives no security patches, which fails the Essential Eight’s patch operating systems control at every maturity level, and runs Revit on an operating system Autodesk no longer tests against.
So: a fleet audit. Every Windows 10 machine either goes to Windows 11 or goes out the door, and the only resources you need are Microsoft’s PC Health Check and a spreadsheet with a row per workstation. In practice the two lists overlap almost perfectly, because a machine that fails the Windows 11 hardware check is usually a machine that struggles with Revit anyway. Autodesk’s Revit 2026 requirements ask for 16 GB of memory at entry level and 64 GB or more for large models. A 2017 workstation with 16 GB and a TPM problem is not one to fight for.
Late 2025: ASD puts the average medium-business cybercrime at $97,200, and the OAIC logs a record year
The Australian Signals Directorate’s Annual Cyber Threat Report 2024–25 puts the average self-reported cost of a cybercrime for a medium business at $97,200, up 55 per cent in a year. The Office of the Australian Information Commissioner recorded 1,205 notifiable data breaches in 2025, the highest annual number since the scheme began. Synology’s research, published in July 2026, found backups were the first target in 94 per cent of ransomware attacks. Read those three together and they say one thing: the backup is what the attacker goes for, and it costs about a hundred thousand dollars when they get it.
Run a restore test and an immutability check this week, not at the next quarterly review, and answer one question while you’re at it: could an account compromised on your network delete the backup along with the project drive? If it could, you don’t have a backup, you have a second copy, and the Essential Eight at Maturity Level Two says as much in its own words. The disaster recovery page covers what a real test looks like.
2024: Western Australia requires 24-hour incident reporting from suppliers
The 2024 Western Australian Government Cyber Security Policy requires service providers to report a cyber incident within 24 hours of detection, sets Essential Eight Maturity Level One as the minimum with Level Two where appropriate, and allows penalties or termination for failing to comply. Twenty-four hours. South Australia’s Cyber Security Framework supplier guideline asks providers to state where data is held, including replicas and backups, and to run multi-factor authentication. Queensland points at the same maturity model through IS18.
Any consultant with a state government client in those three states should be able to state its Essential Eight maturity level, say where its data sits, down to the site the backups replicate to, and produce a written 24-hour incident process, all before the questionnaire arrives. It usually arrives with the tender, and at that point you want to ensure the answer describes this year’s setup rather than the one from before the office moved. The Essential Eight guide covers the maturity levels for a Revit environment.
7 February 2024: Autodesk multi-user renewals ended
Autodesk’s multi-user, or network, subscriptions stopped being renewable on 7 February 2024, the end of a transition that began in August 2020 with a trade-in of two named-user subscriptions for each multi-user seat. Every Autodesk subscription is now assigned to one named person, installable on up to three devices, one instance at a time, and it can’t be shared.
Two years on, the job is a recount. A practice that traded in at two to one in 2021 is often paying for more seats than it has people, and when a drafter leaves, the seat stays on the invoice until an admin in the Autodesk account reassigns it, which nobody remembers to do in the week someone resigns. The named-user page explains the rules and the quarterly check.
What we're watching, and how to get the next advisory
A caveat about this list. It only carries items with a date and something to do, which means it leaves out rumour, roadmap and whatever a vendor’s blog said last week. When Autodesk publishes a price change for Australia, when the ACSC revises the Essential Eight maturity model, or when a state agency sets a new information management deadline, it goes here with the source attached. We email each advisory to clients as it lands, with the action for their environment. If a client forwards you something that isn’t on the list, send it to us. We’ll tell you whether it’s real, and the content here gets updated as each item lands.
- Written by
Written and reviewed by the NexSys engineers, design technology specialists and consultants who build and support IT for architecture, engineering and construction firms across Australia. Every price, rule and vendor statement is checked against its source on the date shown.
- Through 2026: Autodesk security advisories keep landing on file-parsing flaws in Revit, AutoCAD and 3ds Max
- May 2026: Revit 2021 and earlier lose cloud model access
- 7 April 2026: Autodesk Revit 2027 released
- September 2025: Infrastructure NSW requires ISO 19650 on state projects
- 14 October 2025: Windows 10 support ended
- Late 2025: ASD puts the average medium-business cybercrime at $97,200, and the OAIC logs a record year
- 2024: Western Australia requires 24-hour incident reporting from suppliers
- 7 February 2024: Autodesk multi-user renewals ended
- What we’re watching, and how to get the next advisory
Recent Posts
- Workflow Automation for Architecture and Engineering Firms: 2026
- IT Support for Architecture Firms With Internal IT Teams
- Cloud Infrastructure for Revit and BIM Workloads: A Guide
- IT Asset Management for AEC Firms: Digital Efficiency and Compliance
- BIM’s Next Leap: Automation, Validation, and Data Trust in AEC
Get the advisories before the deadline
We send these to clients as they happen, with the action for their environment. If you would rather hear about Revit 2027’s cloud cutoff before the day it bites, book a strategic review.