Quick answers
- Is CVE-2026-108160 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-108160 being exploited in the wild.
- How severe is CVE-2026-108160?
- High severity, with a CVSS score of 7.5, published 9 October 2026.
- Which products and versions are affected?
- iFlytek AstronRPA through 1.1.6.
- Is there a fix for CVE-2026-108160?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-108160 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-108160?
- Check whether you run iFlytek AstronRPA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability exists in the electron-updater implementation, which downloads and executes NSIS installers without signature verification (verifyUpdateCodeSignature is explicitly set to false in electron-builder.json). An attacker performing a man-in-the-middle attack can serve a malicious update manifest and installer that the client will install and execute without integrity or authenticity checks. Affected versions are through 1.1.6.
Affected products
- iFlytek AstronRPA through 1.1.6
Timeline
- 2026-10-09: disclosed