APT flaw in Debian and Ubuntu lets traffic attackers run code as root
A critical flaw in APT, the package manager used by Debian and Ubuntu, lets an attacker who can modify package downloads replace a verified package with malicious code that runs as root. Debian, Ubuntu and APT developers disclosed the vulnerability on November 4, 2026, and assigned it CVE-2026-109518.
The attack works when APT retries a failed download. A malicious mirror, proxy or another party able to change HTTP traffic can use redirects and temporary server errors to trigger the retry, according to Ubuntu and APT's developers. The computer runs the attacker's code when it installs the package.
APT enables this retry behavior by default from Debian 12 and Ubuntu 22.04 onward, according to the advisories. Ubuntu rates the vulnerability as high priority and gives it a CVSS 4.0 score of 7.7. Ubuntu also said that distributions built on Debian and Ubuntu are affected, without naming them.
Debian has released fixed APT versions, including version 2.2.5 for Debian 11. Ubuntu published these builds in its security archive on November 4: 3.3.3ubuntu0.1 for Ubuntu 26.10, 3.2.1ubuntu0.1 for Ubuntu 26.04 LTS, 2.8.4ubuntu0.1 for Ubuntu 24.04 LTS and 2.4.15ubuntu0.1 for Ubuntu 22.04 LTS. Ubuntu 14.04 users with Ubuntu Pro can already obtain an update, while further Ubuntu Pro updates were being released.
Older Debian 11 and Ubuntu 20.04 installations are not exposed by default, Ubuntu said, but user scripts may have enabled the Acquire::Retries setting on those releases. Debian's testing branch still used the vulnerable APT version 3.3.5 at 14:58 UTC on November 4. The advisories did not report exploitation, provide a workaround for systems that cannot update, or establish whether package sources reached over HTTPS are affected.