Debian and Ubuntu APT Vulnerability Allows Root Code Execution (CVE-2026-109518)
Original title: Debian and Ubuntu Linux APT Vulnerability Allows Attackers to Execute Malicious Code With Root Privileges
CVE-2026-109518 in APT lets on-path attackers install malicious packages with root privileges via HTTP redirects and retry mishandling.
The flaw occurs when APT merges redirects and retries downloads, creating a time-of-check time-of-use condition that lets an attacker replace verified packages. Exploitation requires control of HTTP traffic and non-zero retry settings. It affects Debian and Ubuntu derivatives. Fixed in APT 3.0.4 for Debian Trixie and specific Ubuntu versions. No active exploitation reported.
- Affects Debian, Ubuntu and derivatives
- CVSS v4.0 score of 7.7
- Fixed in APT 3.0.4 (Debian Trixie)
- Ubuntu patched versions include 2.4.15ubuntu0.1 for 22.04 LTS
- No default exploitation on older releases with retries zero
- 1.Upgrade to APT 3.0.4 or Ubuntu patched versions
- 2.Set Acquire::Retries to zero if using older versions
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-109518 | Man-in-the-middle RCE in APT on Debian and Ubuntu | 7.7 | <1% | PoC ×2 |
From the original article
2 min read at gbhackers.com
A vulnerability in the APT package manager lets attackers intercept communications between Linux systems and package repositories, install malicious packages, and execute code with root privileges. This flaw, tracked as CVE-2026-109518, affects Debian, Ubuntu, and their derivative distributions under certain download conditions. Debian disclosed the issue in its DSA-6607-1 security advisory on November 4, 2026, […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.