Remote Code Execution Vulnerability in Debian and Ubuntu Package Management
CVE-2026-109518

7.7HIGH

Key Information:

Vendor

Debian
Status
Apt
Vendor
CVE Published:
4 November 2026

Badges

📰 News Worthy

What is CVE-2026-109518?

An attacker capable of manipulating HTTP traffic on Debian and Ubuntu systems can exploit vulnerabilities within the APT client. By improperly utilizing hard links and necessitating the client to follow redirects, attackers can coerce the installation of unverified packages, which could allow them to execute arbitrary code with root privileges. This vulnerability specifically affects installations with a modified Acquire::Retries setting, with the default value set to three beginning in Debian 12 and Ubuntu 22.04 LTS.

Affected Version(s)

APT 0 < 1.2.36

APT 1.4.0 < 1.4.12

APT 1.6.0 < 1.6.19

News Articles

favicon imageThe Hacker News

Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root

APT flaw CVE-2026-109518 lets attackers with HTTP traffic control replace verified packages and execute code as root when downloads retry.

2 hours ago

References

https://lists.debian.org/debian-security-announce/2026/ms...
vendor-advisory
https://ubuntu.com/security/notices/USN-8996-1
vendor-advisory

CVSS V4

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • 📰

    First article discovered by The Hacker News

  • Vulnerability published

  • Vulnerability Reserved

Credit

Max Justicz
Julian Andres Klode
.