Improper Name Resolution in Devolutions UniGetUI Affects Application Integrity
CVE-2026-10696

7.5HIGH

Key Information:

Vendor

Devolutions

Status
Unigetui
Vendor
CVE Published:
17 June 2026

What is CVE-2026-10696?

A vulnerability in Devolutions UniGetUI allows malicious WinGet community catalog contributors to compromise application integrity. This occurs due to incorrect name resolution in the pinget backend, enabling an attacker to connect an installed application to a deceptive, attacker-controlled catalog package. If a user applies a proposed update that utilizes this crafted catalog, it could lead to the inadvertent execution of an untrusted installer. Users must remain vigilant about updates and verify sources to mitigate risks.

Affected Version(s)

UniGetUI 0 <= 2026.2.1

References

https://devolutions.net/security/advisories/DEVO-2026-0019

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.