CVE-2026-10696: High severity Devolutions UniGetUI vulnerability
Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an installed application to be correlated to an unrelated, attacker-controlled catalog package and to execute an attacker-controlled installer via a crafted catalog package whose normalized name is contained as a substring within the installed application name when a user applies the proposed update.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
If possible, disable the pinget backend or any WinGet community-catalog fetching functionality in Devolutions UniGetUI to prevent correlation of installed applications with community catalog packages.
Devolutions UniGetUI (pinget backend) pinget backend usage = disabled - Compensating control
Do not add or trust WinGet community catalogs and restrict the ability to add or update community catalogs to trusted administrators; block or limit access to untrusted community catalogs via network controls or endpoint policy until a vendor fix is available.
- Operational
Avoid applying proposed updates originating from WinGet community catalogs; manually verify the catalog package source and installer integrity before applying updates, and await an official vendor fix for UniGetUI (versions 2026.2.0 and earlier are affected).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10696?
CVE-2026-10696 has a risk rating of 56.
How do I fix CVE-2026-10696?
To fix CVE-2026-10696, upgrade to Devolutions UniGetUI version 2026.2.1 or later.
What impact does CVE-2026-10696 have on affected systems?
CVE-2026-10696 allows an attacker to correlate installed applications with unrelated packages from an attacker-controlled catalog.
Who is affected by CVE-2026-10696?
CVE-2026-10696 affects users of Devolutions UniGetUI version 2026.2.0 and earlier.
Is there a workaround for CVE-2026-10696?
Currently, there are no known workarounds for CVE-2026-10696; updating to the latest version is recommended.