Is CVE-2026-10696 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-10696 being exploited in the wild.

How severe is CVE-2026-10696?

High severity, with a CVSS score of 7.5, published 17 June 2026.

Which products and versions are affected?

Devolutions UniGetUI 2026.2.0 and earlier.

Is there a fix for CVE-2026-10696?

A patch was published on 2026-06-17: Fixed in version 2026.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-10696 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-10696?

Check whether you run Devolutions UniGetUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-10696: Devolutions UniGetUI incorrect package correlation in pinget backend

CVE-2026-10696 · Severity: high · CVSS 7.5 · Published 2026-06-17

UniGetUI is a tool used to manage, install, and update Windows software packages. A vulnerability in how the tool identifies software updates allows a malicious contributor to a public software catalog to trick the system into replacing a legitimate application with a malicious one. If a user accepts a proposed update for an affected application, the tool will execute an attacker-controlled installer, potentially leading to a full system compromise.

Vendors: Devolutions.

Quick answers

Is CVE-2026-10696 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-10696 being exploited in the wild.
How severe is CVE-2026-10696?: High severity, with a CVSS score of 7.5, published 17 June 2026.
Which products and versions are affected?: Devolutions UniGetUI 2026.2.0 and earlier.
Is there a fix for CVE-2026-10696?: A patch was published on 2026-06-17: Fixed in version 2026.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10696 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-10696?: Check whether you run Devolutions UniGetUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the pinget backend of Devolutions UniGetUI (version 2026.2.0 and earlier) due to the use of an incorrectly resolved name or reference (CWE-706). The flaw allows a WinGet community catalog contributor to craft a package whose normalized name is a substring of a legitimate installed application's name. This causes UniGetUI to incorrectly correlate the installed application with the attacker's malicious package. When a user attempts to apply what appears to be a legitimate update, the application instead executes the attacker-controlled installer. This vulnerability is remediated in version 2026.2.1.

Affected products

Devolutions UniGetUI 2026.2.0 and earlier

Timeline

2026-06-17: disclosed
2026-06-17: advisory
2026-06-17: patched: Fixed in version 2026.2.1

References

https://devolutions.net/security/advisories/DEVO-2026-0019

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.