Ubuntu Advantage Tools Vulnerabilities Lead to Security Risks

On September 1, 2026, Ubuntu released USN-8555-2 to address a regression introduced by USN-8555-1 in Ubuntu Advantage Tools, affecting Ubuntu 14.04 LTS. The vulnerabilities, discovered by Bilal Teke and Frederick Jerusha, included exposure of the Pro bearer token in command-line arguments (CVE-2026-9494) and improper validation of data from the contract server, allowing potential arbitrary code execution. Additionally, Mateusz Gierblinski identified an issue with symbolic link handling that could expose sensitive information on various Ubuntu versions. The update resolves the regression preventing esm-infra-legacy from being enabled. Users are advised to update their systems to mitigate these risks.

Key Points: • Ubuntu Advantage Tools had vulnerabilities allowing unauthorized access and code execution. • The regression affected only Ubuntu 14.04 LTS, causing issues with enabling esm-infra-legacy. • Multiple CVEs were identified, including CVE-2026-9494 and CVE-2026-12391, necessitating immediate updates.