Weekly recap: OpenSSH SSHole probed, Zyxel zero-day hits switches
Twenty OpenSSH attempts came from 13 IPs, and a Zyxel flaw was used on nearly 1,000 switches.
74
CVE-2026-109518
Man-in-the-middle RCE in APT on Debian and Ubuntu
- CVSS 4.0
- 7.7 high
- EPSS
- <1%p61
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
An on-path attacker manipulates HTTP traffic between an APT client and archive server, tricking the client into installing an unverified malicious package during redirect retry. This achieves remote code execution as root. It affects Debian, Ubuntu, and derivatives when using default Acquire::Retries (3 on bookworm/Jammy) and requires following redirects.
What to do: Upgrade to latest APT packages. Apply Debian and Ubuntu update for CVE-2026-109518.
| Product | Affected |
|---|---|
| Debian APT | 12 (bookworm) |
| Ubuntu APT | 22.04 LTS (Jammy Jellyfish) |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration
- Weakness
- CWE-62, CWE-367
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
8 storiesDebian and Ubuntu APT Vulnerability Allows Root Code Execution (CVE-2026-109518)
CVE-2026-109518 in APT lets on-path attackers install malicious packages with root privileges via HTTP redirects and retry mishandling.
70
Debian and Ubuntu APT flaw allows package swap
The flaw in APT lets MitM attackers swap verified packages and run code as root when retries are enabled.
70
Debian APT flaw lets attackers hijack updates and run code as root
CVE-2026-109518 in APT allows network attackers to replace verified packages and execute code as root on Debian releases.
70
Debian Ubuntu patch APT flaw allowing root via redirects
CVE-2026-109518 in APT lets MITM attackers install packages with root privileges using HTTP redirects and retries.
65
Debian apt security update for CVE-2026-109518
Max Justicz found vulnerability allowing man-in-the-middle attackers to execute arbitrary code as root after HTTP redirects.
60
CVE-2026-109518: RCE in Debian apt package manager
Debian advisory reveals man-in-the-middle vulnerability in APT allowing package replacement.
50
Debian apt security update fixes man-in-the-middle code execution
Max Justicz discovered a vulnerability in apt allowing man-in-the-middle attackers to execute arbitrary code as root by merging package downloads; fixed in version 3.0.4.
50