APT Vulnerability CVE-2026-109518: Patch Debian and Ubuntu Now

Canonical and the Debian Project have shipped emergency patches for a new APT vulnerability, tracked as CVE-2026-109518, that lets an attacker positioned between a Linux machine and a package mirror trick apt into installing an unverified, attacker-controlled .deb file with root privileges. The flaw was reported by security researcher Max Justicz, carries a CVSS v4.0 score of 7.7 (High), and affects Debian 12 and later and Ubuntu 22.04 LTS and later by default, because those releases turn on APT's download-retry behavior out of the box. Fixed apt packages are already rolling out through Debian's and Ubuntu's normal update channels — admins and desktop users who run apt update && apt upgrade get the patch automatically.

What Is CVE-2026-109518?

CVE-2026-109518 is a vulnerability in APT, the Advanced Package Tool that Debian, Ubuntu, and nearly every Debian-derived distribution (Linux Mint, Pop!_OS, Kali Linux, Raspberry Pi OS, and most cloud base images) use to install and update software. According to the Debian Security Tracker, the bug lets an on-path attacker — someone who can manipulate the HTTP traffic between an APT client and an archive server, for example by running a malicious mirror, a compromised Wi-Fi hotspot, or a rogue proxy — cause the client to accept and install a package that never passed APT's cryptographic signature verification. Because APT package installs run as root, a successful attack hands the attacker full control of the machine.

The bug lives in APT's HTTP transport backend, so this CVE affects every front end that uses it, including the command-line apt and apt-get tools, GUI package managers, and unattended-upgrade scripts. Canonical's advisory notes that Snap packages are not affected, since Snap uses a different transport and verification path entirely.

Reading the published CVSS v4.0 vector — AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H — tells you most of what you need to know about who should worry. AV:N means the attack is launched over the network, not from local access. AT:P flags that the attacker needs specific conditions present (the plain-HTTP, non-zero-retry setup described below), which is why the overall score lands at 7.7 rather than a maximum 10.0. PR:N and UI:P mean the attacker needs no credentials on the target but does depend on the victim's machine performing an ordinary, user-initiated action — in this case, simply running a routine apt update or apt upgrade. And the three "High" impact metrics (VC, VI, VA) reflect that a successful exploit gives the attacker complete confidentiality, integrity, and availability impact, because it ends in arbitrary code execution as root.

How the APT Hijack Attack Works

APT normally verifies every package's cryptographic signature against the distribution's trusted keyring before it lets dpkg unpack and install the file. CVE-2026-109518 doesn't break that signature check directly — it exploits how APT handles HTTP redirects and retried downloads to swap in a different file after the legitimate one has already been verified.

The Debian Security Tracker's technical summary describes the root cause as reuse of hard links: when an HTTP download is interrupted and APT retries it, or when a redirect points two different downloads at the same URI, APT can end up linking the verified package's on-disk file to a path that a subsequent, attacker-controlled download later overwrites. An attacker sitting in a man-in-the-middle position on the network path — a hostile mirror operator, a compromised ISP link, or anyone who can intercept HTTP (not HTTPS) traffic to an apt repository — can time that swap so the file that actually gets installed is their own payload, signed or not.

Two conditions have to line up for the attack to work: the connection to the package server has to be plain HTTP rather than HTTPS, and APT's Acquire::Retries option — which controls how many times APT retries a failed download — has to be set to a non-zero value. That second condition sounds like a narrow edge case, but it isn't: Canonical's advisory states that Acquire::Retries defaults to 3 starting with Ubuntu 22.04 LTS and Debian 12 "bookworm," which means both distributions are vulnerable out of the box unless an administrator has explicitly disabled retries.

Who Found the Bug, and Why It Looks Familiar

The researcher credited with the discovery, Max Justicz, previously found and reported a conceptually similar APT redirect-handling flaw, CVE-2019-3462, which Debian and Ubuntu patched in January 2019. That earlier bug also let a network attacker smuggle unverified content into an APT install via mishandled HTTP redirects. CVE-2026-109518 is a different, newly introduced code path — Canonical's write-up attributes it to hard-link handling during retried downloads rather than redirect header parsing — but the class of bug (an on-path attacker abusing APT's HTTP fetch-and-retry logic to defeat package verification) is the same one Justicz flagged seven years earlier, which is part of why the finding is getting attention from the Linux security community this week.

Is My System Affected?

Your system is affected if all of the following are true:

• You run Debian, Ubuntu, or a Debian/Ubuntu derivative that installs software through APT.
• At least one of your configured /etc/apt/sources.list entries (or a file under /etc/apt/sources.list.d/) points to a plain http:// mirror rather than https:// or a signed local repository.
• APT's retry setting (Acquire::Retries) is non-zero, which is the out-of-the-box default on Ubuntu 22.04 LTS and newer, and Debian 12 "bookworm" and newer.

If every repository you use is already HTTPS-only, the Ubuntu advisory notes that the encrypted transport blocks this specific attack path even on an otherwise-vulnerable APT version, because an on-path attacker can't tamper with or replay an HTTPS download the way they can with plain HTTP. Many official Debian and Ubuntu mirrors still offer HTTP endpoints for compatibility, however, so the safest move is to install the patched APT version regardless of which transport you use today.

Affected and Fixed Versions

Debian shipped the fix as DSA-6607-1 (Debian 13 "trixie") and DLA-4880-1 (Debian 12 "bookworm," via the Debian LTS team), both dated November 4, 2026. Canonical published matching updates for every supported Ubuntu release the same day, including Ubuntu Pro extended-security-maintenance builds for releases that are otherwise past their standard support window.

The oldest Ubuntu releases (20.04 and earlier) only receive the fix through a paid or free-tier Ubuntu Pro subscription or the Legacy Support add-on, since those versions are past their standard five-year support window.

How to Patch Debian and Ubuntu Now

For nearly everyone, the fix is a single routine update, because the patched apt package fixes the tool that installs every other package:

1. Run sudo apt update followed by sudo apt upgrade (or sudo apt full-upgrade) from a trusted network connection — ideally one where you aren't relying on an untrusted public Wi-Fi hotspot for the update itself.
2. Confirm the installed version matches or exceeds the fixed version for your release in the table above by running apt-cache policy apt.
3. If you administer servers through automation (Ansible, Puppet, cloud-init, golden AMIs/images), rebuild or patch your base images so new instances don't launch with the vulnerable apt binary.
4. Audit your sources.list and any third-party .list files under /etc/apt/sources.list.d/ and switch any plain http:// mirror entries to https:// where the mirror supports it, as defense in depth even after patching.
5. If you can't patch immediately, Canonical and Debian's guidance is to set Acquire::Retries "0"; in /etc/apt/apt.conf.d/ as a stop-gap, which removes the retry condition the attack depends on — though it means a flaky network connection will cause update commands to fail outright instead of retrying.

Is CVE-2026-109518 Being Exploited?

As of publication, neither Canonical nor the Debian Security Team has reported in-the-wild exploitation of CVE-2026-109518, and it does not yet appear on CISA's Known Exploited Vulnerabilities catalog. That's typical for a researcher-reported bug that both vendors patched the same day it was disclosed — the window of risk is narrower than for a true zero-day, but it is not zero, because the underlying attack technique and the affected code path are now public. Organizations that rely on self-hosted or third-party HTTP mirrors inside a data center — the exact "malicious mirror or proxy" scenario the advisories describe — carry the most realistic exposure and should prioritize patching over systems that only ever talk to the official HTTPS archive endpoints.

Why This Matters Beyond Debian and Ubuntu

APT is the install mechanism underneath a huge share of the internet's Linux servers, containers, and desktops, not just stock Debian and Ubuntu installs. Any distribution built on Ubuntu or Debian packaging — Linux Mint, Pop!_OS, elementary OS, Kali Linux, Raspberry Pi OS, and the base images many cloud providers offer for virtual machines and containers — inherits whichever version of apt it ships with, and most of them pull updates from the same upstream security channels once their maintainers rebase on the fixed Debian or Ubuntu packages. This also lands in the same week as a separate, unrelated Linux kernel vulnerability patched for CISA, underscoring how much of the current patch workload for Linux fleets is concentrated in core plumbing — the kernel and the package manager — rather than in any single application.

Enterprise Mirrors and Internal Repositories Carry the Most Risk

Public Debian and Ubuntu archive mirrors have largely moved to HTTPS by default, which narrows the practical attack surface for a home desktop or laptop pulling updates straight from the internet. The bigger exposure sits inside organizations that run their own internal package mirrors or caching proxies — tools like apt-mirror, apt-cacher-ng, or a corporate artifact repository re-serving Debian and Ubuntu packages to a fleet of servers — because those internal setups have historically been configured over plain HTTP on the theory that the traffic never leaves a trusted internal network. CVE-2026-109518's threat model assumes exactly that kind of setup: anyone who can get onto the same network segment as the mirror, including a compromised adjacent host, a rogue VM in a shared hypervisor, or a malicious insider, is an "on-path attacker" in the terms the advisory uses. Teams running internal apt infrastructure should treat the HTTP-to-HTTPS migration for those internal mirrors as the longer-term fix, with the November 4 apt patch as the immediate one.

Container and image-building pipelines deserve the same attention. Official Debian- and Ubuntu-based container base images rebuild regularly, but any Dockerfile, Packer template, or golden-image pipeline that bakes in packages at build time inherits whatever apt version was present when that image was last built. Rebuilding base images after a patch like this ships is the same principle that applies to any other base-image CVE: the fix only reaches running workloads once the image itself is rebuilt and redeployed, not automatically the next time a container starts.

What's Next

Expect downstream Ubuntu derivatives and unofficial Debian spins to publish their own rebuilt packages over the coming days as their maintainers rebase on the patched upstream apt release; users of those distributions should watch their own project's advisories rather than assuming Canonical's or Debian's fix reaches them automatically through a shared repository. The APT maintainers' public fix, merged into the apt 3.3.6 development branch on Debian's GitLab instance, gives downstream packagers a reference patch to port to older branches if they maintain their own long-term-support forks. For most individual Linux users and administrators, though, the practical next step is already available: apply the November 4, 2026 update through your normal package manager, verify the version, and move on — this is not a bug that requires a new tool or a config rewrite to fix, just a prompt, ordinary system update.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage