CVE-2026-109518: Critical APT Vulnerability Allows Attackers to Execute Commands as Root on Debian and Ubuntu

A newly disclosed security vulnerability in APT, the package manager used by Debian and Ubuntu, could allow attackers to install malicious software and execute commands with root privileges. Tracked as CVE-2026-109518, the vulnerability exploits weaknesses in HTTP redirects and interrupted package downloads, potentially bypassing APT’s package integrity verification. System administrators should check their installed APT versions and apply the available security updates immediately.

Summary

CVE-2026-109518 is a high-severity vulnerability in APT that allows a network-based attacker to manipulate package downloads and potentially execute malicious code with root privileges. It affects Debian and Ubuntu systems under specific network and configuration conditions. Debian and Ubuntu have released security updates, and administrators should upgrade APT as soon as possible.

Table of Contents

1. What Is CVE-2026-109518?
2. How Does the APT Vulnerability Work?
3. Which Debian and Ubuntu Versions Are Affected?
4. How to Check Your APT Version
5. How to Protect Your Linux System
6. Frequently Asked Questions
7. Conclusion

1. What Is CVE-2026-109518?

APT (Advanced Package Tool) is the package management system used by Debian, Ubuntu, and many other Debian-based Linux distributions.

It allows administrators and users to install, update, and remove software using commands such as:

sudo apt update
sudo apt upgrade
sudo apt install nginx

APT also includes security mechanisms designed to verify downloaded packages and protect systems against malicious software.

However, security researchers discovered a vulnerability in how APT handles HTTP redirects and interrupted downloads.

The vulnerability, identified as CVE-2026-109518, has a CVSS 4.0 score of 7.7 (High).

An attacker positioned between a Linux system and its package repository could manipulate network traffic and potentially replace a legitimate package with a malicious one.

If the malicious package gets installed, its installation scripts can execute with root privileges, giving the attacker significant control over the affected system.

2. How Does the APT Vulnerability Work?

The vulnerability involves the way APT handles HTTP redirects and resumes interrupted package downloads.

Under specific conditions, APT can incorrectly handle two package downloads that lead to the same URI after an HTTP redirect.

An attacker who can manipulate the communication between the system and its package repository may exploit this behavior to replace a package after its verification process.

The attack generally involves:

1. The Linux system attempts to download a package through an HTTP connection.
2. The package server responds with an HTTP redirect.
3. The download encounters an interruption or temporary server error.
4. APT retries the download and incorrectly handles reused files or hard links.
5. An attacker manipulates the download process to introduce a malicious package.
6. The malicious package gets installed and executes code with root privileges.

The main concern is that this vulnerability can undermine APT’s package verification protections.

Normally, APT verifies package integrity using repository metadata and cryptographic signatures. However, this vulnerability creates a way to bypass those protections under the required attack conditions.

Important: This is not a vulnerability that allows every remote attacker to compromise any Debian or Ubuntu machine automatically. The attacker needs to be in a position to manipulate the relevant network traffic, and the vulnerable download conditions must occur.

3. Which Debian and Ubuntu Versions Are Affected?

The vulnerability affects multiple APT versions across Debian and Ubuntu releases.

The default Acquire::Retries setting is particularly important. It is set to 3 in Debian 12 (Bookworm) and Ubuntu 22.04 LTS (Jammy) and newer releases.

Here are some confirmed fixed versions:

Debian

Distribution	Fixed APT version
Debian 12 (Bookworm)	2.6.2
Debian 13 (Trixie)	3.0.4

Debian users should consult the official security tracker for the status of other branches.

Ubuntu

Ubuntu release	Fixed APT version
Ubuntu 22.04 LTS	2.4.15ubuntu0.1
Ubuntu 24.04 LTS	2.8.4ubuntu0.1
Ubuntu 26.04 LTS	3.2.1ubuntu0.1
Ubuntu 26.10	3.3.3ubuntu0.1

Older Ubuntu releases also have security fixes available through their applicable extended security maintenance programs.

Source: Ubuntu Security Advisory and Debian Security Advisory. Ubuntu+3

4. How to Check Your APT Version

Linux administrators should first identify the installed APT version and compare it with the fixed versions listed above.

Run the following command:

apt --version

To display the installed APT package information:

apt list --installed '?source-package(^apt$)'

You can also check the retry configuration:

apt-config dump | grep -i Acquire::Retries

If the value is non-zero, your system has the retry behavior associated with this vulnerability. However, this alone does not confirm that your system is vulnerable: the installed APT version and distribution security status also matter.

5. How to Protect Your Linux System

Debian and Ubuntu have published security updates to address CVE-2026-109518.

Administrators should prioritize installing these updates.

Step 1: Update APT and installed packages

On Ubuntu and Debian, run:

sudo apt update
sudo apt upgrade

For additional protection during the update process, temporarily disable download retries:

sudo apt update && sudo apt upgrade -o Acquire::Retries=0

This is the mitigation recommended by Ubuntu while installing the security updates.

Step 2: Upgrade APT separately if necessary

If you cannot upgrade all packages immediately, you can target APT:

sudo apt update
sudo apt install -o Acquire::Retries=0 --only-upgrade apt

After installation, check the version again:

apt --version

Make sure it matches the fixed version for your distribution.

Step 3: Use HTTPS for package repositories

Using HTTPS helps prevent attackers from intercepting and manipulating HTTP traffic between your Linux system and package repositories.

Check your configured repositories:

grep -R "http://" /etc/apt/sources.list /etc/apt/sources.list.d/

Where supported, replace HTTP repository URLs with HTTPS.

For standard Ubuntu archive repositories, the following command can update the URLs:

sudo sed -Ei 's!http://((([a-z]+\.)?archive|security|ports)\.ubuntu\.com)!https://\1!' \
/etc/apt/sources.list /etc/apt/sources.list.d/*.list \
/etc/apt/sources.list.d/*.sources

Then refresh the package lists:

sudo apt update

Note: Not every third-party or community mirror supports HTTPS. Check repository compatibility before changing its URL. HTTPS is an additional protection, not a replacement for installing the security update.Ubuntu+2

6. Frequently Asked Questions (FAQ)

Does CVE-2026-109518 affect Ubuntu servers?

Yes. Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and other affected releases require security updates. The exact status depends on the installed APT version.

Can this vulnerability give attackers root access?

Yes. A successful attack can result in the installation of a malicious Debian package. Package installation scripts execute with root privileges, potentially allowing attackers to execute arbitrary commands as root.

Does using HTTPS protect against this vulnerability?

HTTPS protects package downloads against the relevant network interception attack. However, administrators should still install the official APT security updates.

Is Debian 12 affected?

Yes. Debian 12 (Bookworm) is affected, and Debian has released a fix in APT version 2.6.2.

Should I disable APT download retries permanently?

Not necessarily. Setting Acquire::Retries to zero can mitigate the vulnerability, but it also removes automatic download retries, which can make package downloads less reliable. The recommended solution is to install the security update.

7. Conclusion

CVE-2026-109518 highlights how vulnerabilities in essential Linux components can create serious security risks, even when those components include package verification mechanisms.

Because APT handles software installation with administrative privileges, a successful attack could compromise an entire Linux system.

If you manage Debian or Ubuntu servers, check your APT version, install the latest security updates, and use HTTPS for supported package repositories. Do not rely on temporary mitigations instead of applying the official patches.

Official Security References

• Ubuntu – APT Vulnerability Fixes Available
• Ubuntu Security – CVE-2026-109518
• Debian Security Advisory – DSA-6607-1
• Debian Security Tracker – CVE-2026-109518