APT flaw CVE-2026-109518 lets network attackers swap verified packages on Debian and Ubuntu

What happened

A high-priority vulnerability in APT, the package manager at the core of Debian and Ubuntu, can allow an attacker who controls the connection between a machine and its update server to swap in a malicious package in place of a genuine, verified one and then run code with root privileges. The flaw is tracked as CVE-2026-109518, and according to a Hacks.gr report syndicated on dev.to, the software's developers together with the Debian and Ubuntu teams published advisories and fixed builds on November 4, 2026.

Ubuntu has classified the issue as high priority and noted that distributions derived from Debian and Ubuntu are affected as well.

How the attack works

The problem sits in the way these systems fetch updates. When a package download fails, APT is set to retry automatically. An attacker positioned on the connection — effectively a man-in-the-middle — can interfere with a transfer and abuse that retry behaviour, fooling the client into accepting an attacker-supplied file rather than the authentic one. The outcome is a substituted package that installs on the machine, giving the attacker's code root-level access, the highest privilege on the system.

Which systems are exposed

Exposure depends on the retry configuration. Automatic retries are enabled by default on Debian 12 and on Ubuntu 22.04 and later, so those releases are vulnerable out of the box. On older releases — Debian 11 and Ubuntu 20.04 — the relevant setting is off by default, and those systems are only exposed if a user has turned it on manually.

Fixes are already available

The developers moved quickly to ship corrections. Per the report, new builds fixing the issue are available for Ubuntu 26.10, 26.04 LTS, 24.04 LTS and 22.04 LTS, and a patch has also been published for Debian 11.

As of the announcement, no active exploitation had been identified, and no interim workaround had been documented. It also remains unclear whether package sources reached over encrypted connections are affected by the same technique. The vulnerability was found by researcher Max Justicz.

Why it matters

APT and its verification chain are the foundation of trust on Debian-family systems: administrators apply updates on the assumption that signed packages arrive unmodified from the repository. A flaw that lets a network-level attacker replace a verified package with a malicious one — and gain root in the process — breaks that assumption at its root.

The exposure is broad on paper, because every default installation of Debian 12 or Ubuntu 22.04 and later carries the retry configuration in question. The prerequisite is meaningful, though: the attacker needs control over the traffic between the victim and the update server, which is a stronger position than simply being able to reach a machine on a network. Even so, such a position is plausible wherever the network path is untrusted or manipulated.

Because patched builds are already out and no workaround exists, the practical step is straightforward: update affected systems promptly, including older releases where the retry setting was enabled by hand, and treat the fixed package itself as the mitigation.