CVE-2026-109518

CVE Enrichment

CVSS: 7.7 HIGH
CISA KEV: Not listed

Description

On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges. The vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 04-Nov-2026 23:17
Last Modified: 04-Nov-2026 23:17
CWE: CWE-62, CWE-367

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:P /
                            PR:N /
                            UI:P /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

CNA Products / Version Status

Debian · APT Source: CNA · [email protected]
Default status: unaffected

0 ≤ version < 1.2.36 — affected (dpkg)
1.4.0 ≤ version < 1.4.12 — affected (dpkg)
1.6.0 ≤ version < 1.6.19 — affected (dpkg)
1.8.0 ≤ version < 1.8.2.4 — affected (dpkg)
1.8.3 ≤ version ≤ 1.8.5 — affected (dpkg)
2.0.0 ≤ version < 2.0.12 — affected (dpkg)
2.2.0 ≤ version < 2.2.5 — affected (dpkg)
2.4.0 ≤ version < 2.4.15 — affected (dpkg)
2.6.0 ≤ version < 2.6.2 — affected (dpkg)
2.8.0 ≤ version < 2.8.4 — affected (dpkg)
3.0.0 ≤ version < 3.0.4 — affected (dpkg)
3.2.0 ≤ version < 3.2.1 — affected (dpkg)
3.3.0 ≤ version < 3.3.6 — affected (dpkg)

packageName: apt
Ubuntu · APT Source: CNA · [email protected]
Default status: unaffected

0 ≤ version < 1.0.1ubuntu2.24+esm4 — affected (dpkg)
1.2.0 ≤ version < 1.2.36+esm1 — affected (dpkg)
1.6.0 ≤ version < 1.6.19+esm1 — affected (dpkg)
2.0.0 ≤ version < 2.0.12+esm1 — affected (dpkg)
2.4.0 ≤ version < 2.4.15ubuntu0.1 — affected (dpkg)
2.8.0 ≤ version < 2.8.4ubuntu0.1 — affected (dpkg)
3.2.0 ≤ version < 3.2.1ubuntu0.1 — affected (dpkg)
3.3.0 ≤ version < 3.3.3ubuntu0.1 — affected (dpkg)

packageName: apt

References

Last enrichment sync: 05-Nov-2026 01:01
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

Tracked as CVE-2026-109518, the flaw carries a CVSS 4.0 score of 7.7 and affects APT’s HTTP download and retry handling. CVE-2026-109518 Lets On-Path Attackers Bypass APT Package Verification
On November 4, 2026, Debian and Ubuntu shipped fixes for CVE-2026-109518, a flaw in apt, the package manager used by Debian, Ubuntu, and most of their derivatives. An attacker who can tamper with the network traffic CVE-2026-109518 Lets On-Path Attackers Replace Verified APT Packages and Execute Code as Root
Debian has released fixed versions of APT for the flaw, CVE-2026-109518. APT's developers, who call the flaw critical, say updates for Ubuntu and its Ubuntu Pro subscription service are being released. Ubuntu 14.04 APT Flaw Lets Traffic-Interfering Attackers Replace Verified Packages and Run Code as Root

People (1)

MITRE ATT&CK (2)

Vendors (3)

Products (4)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.