CVE-2026-10696

Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an installed application to be correlated to an unrelated, attacker-controlled catalog package and to execute an attacker-controlled installer via a crafted catalog package whose normalized name is contained as a substring within the installed application name when a user applies the proposed update.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://devolutions.net/security/advisories/DEVO-2026-0019	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:devolutions:unigetui:*:*:*:*:*:*:*:*

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Uso de un nombre o referencia resuelto incorrectamente en el backend de pinget en Devolutions UniGetUI 2026.2.0 y versiones anteriores permite a un colaborador del catálogo de la comunidad de WinGet causar que una aplicación instalada se correlacione con un paquete de catálogo no relacionado y controlado por el atacante, y ejecutar un instalador controlado por el atacante a través de un paquete de catálogo manipulado cuyo nombre normalizado está contenido como una subcadena dentro del nombre de la aplicación instalada cuando un usuario aplica la actualización propuesta.

Information

Published : 2026-06-17 20:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-10696

Mitre link : CVE-2026-10696

CVE.ORG link : CVE-2026-10696

JSON object : View

Products Affected

devolutions

unigetui

CWE

CWE-706

Use of Incorrectly-Resolved Name or Reference

{"id": "CVE-2026-10696", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10696", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-17T19:38:53.962259Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@devolutions.net", "affectedData": [{"vendor": "Devolutions", "product": "UniGetUI", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2026.2.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-17T20:16:47.670", "references": [{"url": "https://devolutions.net/security/advisories/DEVO-2026-0019", "tags": ["Vendor Advisory"], "source": "security@devolutions.net"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@devolutions.net", "description": [{"lang": "en", "value": "CWE-706"}]}], "descriptions": [{"lang": "en", "value": "Use of an incorrectly resolved name or reference in the pinget backend \nin Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community \ncatalog contributor to cause an installed application to be correlated \nto an unrelated, attacker-controlled catalog package and to execute an \nattacker-controlled installer via a crafted catalog package whose \nnormalized name is contained as a substring within the installed \napplication name when a user applies the proposed update."}, {"lang": "es", "value": "Uso de un nombre o referencia resuelto incorrectamente en el backend de pinget en Devolutions UniGetUI 2026.2.0 y versiones anteriores permite a un colaborador del cat\u00e1logo de la comunidad de WinGet causar que una aplicaci\u00f3n instalada se correlacione con un paquete de cat\u00e1logo no relacionado y controlado por el atacante, y ejecutar un instalador controlado por el atacante a trav\u00e9s de un paquete de cat\u00e1logo manipulado cuyo nombre normalizado est\u00e1 contenido como una subcadena dentro del nombre de la aplicaci\u00f3n instalada cuando un usuario aplica la actualizaci\u00f3n propuesta."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:devolutions:unigetui:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "05A08A2C-FB9C-4B76-AC88-4EBF09F72663", "versionEndExcluding": "2026.2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@devolutions.net"}