CVE-2026-109518: How to Fix the Ubuntu APT Vulnerability (CVSS 7.7)

Key Takeaways

• CVE-2026-109518 is a high-severity vulnerability in APT, the package manager used by Ubuntu, Debian, and related Linux distributions.
• CVSS 4.0 score: 7.7 (High). Successful exploitation can allow attackers to install malicious packages and gain root privileges.
• Ubuntu 22.04 LTS and newer are affected by default. Older releases are affected when APT download retries are enabled.
• Security patches are available. Administrators should update APT immediately.

What Is CVE-2026-109518?

On November 4, 2026, Canonical announced fixes for CVE-2026-109518, a vulnerability discovered by security researcher Max Justicz.

The flaw affects APT's HTTP download handling. An attacker capable of manipulating HTTP traffic between a Linux system and its package repository can potentially bypass package verification and install a malicious .deb file.

Because Debian packages can execute installation scripts with root privileges, successful exploitation may result in complete system compromise.

Exploitation requires specific conditions, including a manipulated HTTP connection, a retried download, and a package installation. HTTPS protects against network interception, but installing the official security patch remains essential.

How to Fix CVE-2026-109518

Step 1: Check the installed APT version.

apt list --installed '?source-package(^apt$)'

Compare the installed version against the patched versions below.

Older supported releases have separate fixes available through Ubuntu Pro and Expanded Security Maintenance (ESM).

Step 2: Install security updates.

Canonical recommends running:

sudo apt update && sudo apt upgrade -o Acquire::Retries=0

The Acquire::Retries=0 option temporarily disables APT download retries, preventing the retry condition required for exploitation during the upgrade.

Step 3: Alternatively, upgrade only APT.

sudo apt update && sudo apt install -o Acquire::Retries=0 --only-upgrade '?source-package(^apt$)'

This is useful when a full system upgrade cannot be performed immediately.

Step 4: Verify the installed version.

apt list --installed '?source-package(^apt$)'

Confirm that the installed APT packages match the patched versions for the applicable Ubuntu release.

Additional Protection

• Use HTTPS repositories: HTTPS prevents attackers on the network path from modifying APT downloads. Ensure the configured mirror supports HTTPS before changing repository URLs.
• Avoid untrusted mirrors: A compromised repository mirror can also exploit this vulnerability.
• Keep automatic security updates enabled: Ubuntu's unattended-upgrades can automatically deploy security patches.
• Update Debian systems separately: Debian has also released security fixes. Consult the Debian security tracker for distribution-specific versions.

Important: Switching to HTTPS is a mitigation, not a replacement for updating APT. The vulnerability can also be exploited through malicious package mirrors.

Conclusion

CVE-2026-109518 is a serious APT security vulnerability that can lead to root-level compromise under specific attack conditions.

Canonical released patches on November 4, 2026, and administrators should prioritize updating affected Ubuntu systems.

The fastest recommended fix is:

sudo apt update && sudo apt upgrade -o Acquire::Retries=0

After upgrading, verify the installed APT version and review the official Ubuntu Security Notice USN-8996-1 for additional information.