Skip to content
High-Risk APT Vulnerability Disclosed for Debian and Ubuntu

High-Risk APT Vulnerability Disclosed for Debian and Ubuntu

First seen 4 Nov 2026, 18:17 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 5, 2026 at 00:20 UTC
  • •CVE-2026-109518 allows attackers to swap verified packages with malicious ones.
  • •Affected systems include Debian and Ubuntu versions with non-zero Acquire::Retries settings.
  • •Security updates are available, and users are encouraged to enable HTTPS for APT traffic.

A vulnerability, tracked as CVE-2026-109518, was disclosed on November 4, 2026, affecting the APT package manager in Debian, Ubuntu, and their derivatives. An on-path attacker can manipulate HTTP traffic to install unverified packages, leading to arbitrary code execution with root privileges. The flaw requires the client to have a non-zero Acquire::Retries configuration setting, which is enabled by default in Debian 12 and Ubuntu 22.04. Security updates have been released for all affected Ubuntu versions, while Debian has also issued patches. The vulnerability has a CVSS score of 7.7, categorized as high severity. Users are advised to switch to HTTPS for APT traffic to mitigate the risk. No confirmed exploitation has been reported yet, but the potential for abuse exists due to the nature of the flaw.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 5d ago How this analysis works

Timeline

2026-10-23
First public PoC released
A proof-of-concept for CVE-2026-109518 was made public, demonstrating the vulnerability's exploitability.
Sploitus
2026-11-04
CVE-2026-109518 disclosed
A vulnerability in APT was disclosed, allowing attackers to install unverified packages with root privileges.
Ubuntu
2026-11-04
Patches released for APT
Debian and Ubuntu released security updates for all affected versions of APT to address the vulnerability.
Thehackernews

More articles in this cluster (20)

Following this threat?

Track Debian and CVE-2026-109518 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (5)

1 / 2

Common questions

Which versions are affected?
Debian and Ubuntu versions with a non-zero Acquire::Retries setting are affected, particularly Debian 12 and Ubuntu 22.04 and newer.
Is this vulnerability actively exploited?
No confirmed exploitation has been reported, but the vulnerability is serious due to its potential impact.
What should I do to protect my systems?
Update your APT packages to the latest versions and consider configuring APT to use HTTPS for secure downloads.