Affected Systems
APT package manager on Debian 12+, Ubuntu 22.04+ (default vulnerable). Debian 11 and Ubuntu 20.04 vulnerable if Acquire::Retries enabled. CVE-2026-109518. All Debian/Ubuntu-based distributions affected.
Exploitation Status
No active exploitation reported. Vulnerability disclosed November 4, 2026. Requires MitM position (malicious mirror, proxy, or network attacker). No public PoC mentioned.
Business Impact
Attackers with MitM capability can replace legitimate packages with malicious ones during installation, executing arbitrary code as root. Affects package integrity on HTTP sources. CVSS 4.0 score 7.7 (high). HTTPS exposure status unclear from advisories. Supply chain risk for organizations using local mirrors or proxies.
Urgency
🟠Within 24 hours
Recommended Actions
- Update APT immediately on Debian 12+ and Ubuntu 22.04+ systems using official security repositories (Ubuntu 26.10: 3.3.3ubuntu0.1, 26.04 LTS: 3.2.1ubuntu0.1, 24.04 LTS: 2.8.4ubuntu0.1, 22.04 LTS: 2.4.15ubuntu0.1; Debian 11: 2.2.5)
- Audit Debian 11 and Ubuntu 20.04 systems for custom Acquire::Retries configuration in /etc/apt/apt.conf.d/ and update APT if enabled
- Review and validate integrity of internal APT mirrors and proxies; consider restricting package sources to HTTPS-only repositories
- Monitor APT logs for unusual retry behavior or unexpected HTTP redirects during package operations
- Prioritize patching for systems using HTTP package sources or untrusted network paths to repositories