# CVE-2026-109518: How to Fix the Ubuntu APT Vulnerability (CVSS 7.7)

Fix CVE-2026-109518, a high-severity Ubuntu APT vulnerability that can allow root-level compromise. Check affected versions and apply security patches.

Canonical URL: https://aiidelist.com/blog/cve-2026-109518-ubuntu-apt-vulnerability-fix

Language: en

Published: 2026-11-05

Updated: 2026-11-05

## Key Takeaways

- **CVE-2026-109518** is a high-severity vulnerability in APT, the package manager used by Ubuntu, Debian, and related Linux distributions.
- **CVSS 4.0 score: 7.7 (High).** Successful exploitation can allow attackers to install malicious packages and gain root privileges.
- **Ubuntu 22.04 LTS and newer are affected by default.** Older releases are affected when APT download retries are enabled.
- **Security patches are available.** Administrators should update APT immediately.

## What Is CVE-2026-109518?

On November 4, 2026, Canonical announced fixes for [CVE-2026-109518](https://ubuntu.com/blog/apt-vulnerability-fixes-available), a vulnerability discovered by security researcher Max Justicz.

The flaw affects APT's HTTP download handling. An attacker capable of manipulating HTTP traffic between a Linux system and its package repository can potentially bypass package verification and install a malicious `.deb` file.

Because Debian packages can execute installation scripts with root privileges, successful exploitation may result in **complete system compromise**.

Exploitation requires specific conditions, including a manipulated HTTP connection, a retried download, and a package installation. HTTPS protects against network interception, but installing the official security patch remains essential.

## How to Fix CVE-2026-109518

**Step 1: Check the installed APT version.**

```bash
apt list --installed '?source-package(^apt$)'
```

Compare the installed version against the patched versions below.

| Ubuntu Version | Fixed APT Version |
|---|---|
| 22.04 LTS | `2.4.15ubuntu0.1` |
| 24.04 LTS | `2.8.4ubuntu0.1` |
| 26.04 LTS | `3.2.1ubuntu0.1` |
| 26.10 | `3.3.3ubuntu0.1` |

Older supported releases have separate fixes available through Ubuntu Pro and Expanded Security Maintenance (ESM).

**Step 2: Install security updates.**

Canonical recommends running:

```bash
sudo apt update && sudo apt upgrade -o Acquire::Retries=0
```

The `Acquire::Retries=0` option temporarily disables APT download retries, preventing the retry condition required for exploitation during the upgrade.

**Step 3: Alternatively, upgrade only APT.**

```bash
sudo apt update && sudo apt install -o Acquire::Retries=0 --only-upgrade '?source-package(^apt$)'
```

This is useful when a full system upgrade cannot be performed immediately.

**Step 4: Verify the installed version.**

```bash
apt list --installed '?source-package(^apt$)'
```

Confirm that the installed APT packages match the patched versions for the applicable Ubuntu release.

## Additional Protection

- **Use HTTPS repositories:** HTTPS prevents attackers on the network path from modifying APT downloads. Ensure the configured mirror supports HTTPS before changing repository URLs.
- **Avoid untrusted mirrors:** A compromised repository mirror can also exploit this vulnerability.
- **Keep automatic security updates enabled:** Ubuntu's `unattended-upgrades` can automatically deploy security patches.
- **Update Debian systems separately:** Debian has also released security fixes. Consult the [Debian security tracker](https://security-tracker.debian.org/tracker/CVE-2026-109518) for distribution-specific versions.

**Important:** Switching to HTTPS is a mitigation, not a replacement for updating APT. The vulnerability can also be exploited through malicious package mirrors.

## Conclusion

**CVE-2026-109518 is a serious APT security vulnerability that can lead to root-level compromise under specific attack conditions.**

Canonical released patches on November 4, 2026, and administrators should prioritize updating affected Ubuntu systems.

The fastest recommended fix is:

```bash
sudo apt update && sudo apt upgrade -o Acquire::Retries=0
```

After upgrading, verify the installed APT version and review the official [Ubuntu Security Notice USN-8996-1](https://ubuntu.com/security/notices/USN-8996-1) for additional information.