CVE-2026-109518 APT Vulnerability Fixes Available
Ubuntu, Wednesday, November 4th, 2026
Ubuntu released fixes for CVE-2026-109518, a high-severity APT flaw letting on-path attackers install malicious packages and gain root.
Max Justicz discovered CVE-2026-109518, a vulnerability in APT's HTTP backend rated High with a CVSS 4.0 score of 7.7.
An attacker able to manipulate HTTP traffic between a system and an archive server, or a malicious mirror, can get APT to install a .deb package that fails signature verification, gaining root when its scripts run.
Exploitation requires download retries, so Ubuntu 22.04 LTS and newer are affected by default, while older releases are affected only if Acquire::Retries is non-zero.
Security updates are available for all affected releases; HTTPS sources, FTP and snaps are not affected, and Canonical describes switching APT sources to HTTPS as a mitigation.