A flaw in APT, the package manager at the heart of Debian and Ubuntu, can turn a man-in-the-middle position into full root control of a machine. The bug, tracked as CVE-2026-109518, lets an attacker swap a package that APT has already signature-checked for a malicious one. Advisories from Debian, Ubuntu and APT’s developers landed on 4 November 2026, and fixes are rolling out now. Here is how the attack works, which versions are exposed and what to do today.
What Is the APT Vulnerability?
APT downloads, verifies and installs software packages on Debian, Ubuntu and their many derivative distributions. The flaw breaks the handoff between the verification step and the install step. An attacker who can modify package downloads can replace a checked package with their own, and their code then runs as root when the package is installed.
APT’s developers rate the flaw as critical. Ubuntu rates it high priority with a CVSS 4.0 score of 7.7 and says distributions built on Debian and Ubuntu are affected as well. The issue was reported by Max Justicz.
How the Attack Works
The attack abuses APT’s download retry behaviour.
- The attacker needs a position between the machine and the package server. Ubuntu says this can be anyone who can change the HTTP traffic, including a malicious mirror or a proxy on the network
- The attacker uses HTTP redirects and ordinary temporary server errors to make APT fail and retry the download. APT retries failed downloads by default on Debian 12 and Ubuntu 22.04 and newer
- On the retry, the attacker serves their own package in place of the verified one. APT installs it, and the attacker’s code runs with root privileges
The practical upshot is that a coffee shop Wi-Fi, a compromised office proxy or a shady mirror can become a root-level compromise during a routine package install. None of the three advisories describe in-the-wild attacks so far, and none offer a workaround for systems that cannot update yet. The write-ups describe the attack over HTTP and do not say whether package sources reached over HTTPS are exposed.
Which Versions Are Affected
Systems where APT retries failed downloads by default are the main exposure.
- Debian 12 and newer retry by default and are exposed
- Ubuntu 22.04 LTS and newer retry by default and are exposed
- Debian 11 and Ubuntu 20.04 are not exposed by default, but many user scripts and hardening guides turn on the retry setting, Acquire::Retries, manually. If yours did, treat the system as exposed
- At 15:46 UTC on 4 November, Ubuntu still marked all eight releases it tracks, from 14.04 LTS to 26.10, as vulnerable in its CVE tracker
- Debian’s testing branch was still on the vulnerable APT 3.3.5 at 14:58 UTC on 4 November
Fixed Versions Released
Patched builds are out or rolling out on both distributions.
- Debian released fixed versions of APT for the flaw. For Debian 11, whose long-term support ended on 31 August 2026, APT’s developers published fixed version 2.2.5 separately
- Ubuntu published new APT builds to its security archive at 14:25 UTC on 4 November for four releases: 26.10 (3.3.3ubuntu0.1), 26.04 LTS (3.2.1ubuntu0.1), 24.04 LTS (2.8.4ubuntu0.1) and 22.04 LTS (2.4.15ubuntu0.1)
- Ubuntu Pro: updates are being released for the Ubuntu Pro subscription service, and Ubuntu 14.04 users with Pro can already get the fix
- APT’s developers say updates for the remaining Ubuntu releases are being released in stages
Why This Flaw Matters Beyond Desktops
Desktops are the visible target, but the bigger exposure sits in automation. Build agents, CI runners and container base images install packages from mirrors all day long, often from network positions nobody watches closely. A single unpatched runner pulling packages over HTTP during a nightly build can hand an attacker root on a machine that holds signing keys, deployment tokens and source code.
This is also the rare vulnerability where the fix is tiny and the risk window is loud. The patch touches APT itself, and security researchers expect opportunistic scanning for unpatched mirrors and proxies to start quickly, since the attack only needs a man-in-the-middle position rather than a complex exploit chain.
How to Protect Your Systems
- Update APT first. Run a normal update cycle and make sure the apt package itself upgrades before anything else. On Ubuntu, run sudo apt update followed by sudo apt upgrade. On Debian, the same commands apply once the fixed version reaches your mirror
- Check your APT version. apt –version shows what you are running. Compare it against the fixed versions listed above for your distribution
- Review the Acquire::Retries setting. If you enabled retries manually on Debian 11 or Ubuntu 20.04, you are exposed even though the default is safe. Look for it in /etc/apt/apt.conf.d/ files
- Prefer trusted mirrors and avoid open proxies. The attacker needs to sit between your machine and the package server, so untrusted public Wi-Fi and random mirrors are the highest-risk paths
- Consider HTTPS package sources where your distribution supports them. The advisories describe the attack over HTTP and do not confirm HTTPS behaviour, but encrypted transport removes the middle position entirely
- Prioritise servers over desktops. Any build agent, CI runner or production host that installs packages from the internet should be patched in the first wave
- Rebuild container base images. If your images bake in an old APT version, patching the host is not enough. Rebuild from a fixed base once your distribution’s package lands
- Watch the advisory pages. Debian, Ubuntu and APT’s developers are updating their advisories as fixes reach more releases. Ubuntu’s CVE tracker lists the per-release status
FAQ
What is CVE-2026-109518?
It is a critical flaw in APT, the Debian and Ubuntu package manager, that lets an attacker who can modify package downloads replace a verified package with a malicious one. The malicious code then runs as root. Fixes were released on 4 November 2026.
How do I know if my Ubuntu or Debian system is vulnerable?
If you run Debian 12 or newer, or Ubuntu 22.04 or newer, you are in the affected range because APT retries downloads by default. On older releases, check whether Acquire::Retries has been turned on manually. apt –version tells you whether your APT build includes the fix.
Has the APT flaw been exploited in attacks?
The advisories from Debian, Ubuntu and APT’s developers do not describe any in-the-wild exploitation so far. Because the attack is straightforward for anyone in a man-in-the-middle position, admins should assume it will be attempted and patch quickly.
Does the flaw affect Ubuntu derivatives like Linux Mint?
Ubuntu says distributions built on Debian and Ubuntu are affected as well. If your distribution ships APT from either upstream, treat the flaw as relevant and follow your distribution’s advisory for the fixed version.
