# CVE-2026-10696: Devolutions UniGetUI incorrect package correlation in pinget backend

Source: https://junglewise.ai/threats/cve-2026-10696-devolutions-unigetui-incorrect-package-correlation-in-pinget  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-10696 · Severity: high · CVSS 7.5 · Published 2026-06-17

UniGetUI is a tool used to manage, install, and update Windows software packages. A vulnerability in how the tool identifies software updates allows a malicious contributor to a public software catalog to trick the system into replacing a legitimate application with a malicious one. If a user accepts a proposed update for an affected application, the tool will execute an attacker-controlled installer, potentially leading to a full system compromise.

Vendors: [Devolutions](https://junglewise.ai/threats/vendors/devolutions).

## Quick answers

**Is CVE-2026-10696 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10696 being exploited in the wild.

**How severe is CVE-2026-10696?** High severity, with a CVSS score of 7.5, published 17 June 2026.

**Which products and versions are affected?** Devolutions UniGetUI 2026.2.0 and earlier.

**Is there a fix for CVE-2026-10696?** A patch was published on 2026-06-17: Fixed in version 2026.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10696 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10696?** Check whether you run Devolutions UniGetUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the pinget backend of Devolutions UniGetUI (version 2026.2.0 and earlier) due to the use of an incorrectly resolved name or reference (CWE-706). The flaw allows a WinGet community catalog contributor to craft a package whose normalized name is a substring of a legitimate installed application's name. This causes UniGetUI to incorrectly correlate the installed application with the attacker's malicious package. When a user attempts to apply what appears to be a legitimate update, the application instead executes the attacker-controlled installer. This vulnerability is remediated in version 2026.2.1.

## Affected products

- Devolutions UniGetUI 2026.2.0 and earlier

## Timeline

- 2026-06-17: disclosed
- 2026-06-17: advisory
- 2026-06-17: patched: Fixed in version 2026.2.1

## References

- [https://devolutions.net/security/advisories/DEVO-2026-0019](https://devolutions.net/security/advisories/DEVO-2026-0019)