APT flaw CVE-2026-109518: what to do on Ubuntu and Debian servers

On 4 November 2026 Canonical released fixes for CVE-2026-109518, a high-severity vulnerability (CVSS 4.0: 7.7) in APT, the package manager of Debian, Ubuntu and derivatives. An on-path attacker who can manipulate the HTTP traffic to the package archive, or a malicious mirror or proxy, can trick APT into installing an unverified .deb package. Since packages are installed with administrator privileges, the result is code execution as root.

Unlike the OpenSSH bypass on Alpine published the same day, which mainly concerns musl systems without PAM, this flaw hits the servers most common among Ticino SMEs: Ubuntu VPS (for example on Infomaniak), Debian servers, virtual machines and APT-based Linux workstations.

What Ubuntu and Debian say

According to the Ubuntu security blog and notice USN-8996-1, the flaw was discovered and responsibly disclosed by Max Justicz. It sits in APT’s HTTP backend, in the handling of hard links when a download is redirected and retried. It affects any APT-based frontend: apt, apt-get, aptitude and Ubuntu’s graphical tools.

Three conditions matter for exposure:

• Download retries. Exploitation requires APT to retry a failed download, i.e. Acquire::Retries other than 0. The value 3 is the default from Ubuntu 22.04 LTS and Debian 12: older releases are only affected if the setting was changed.
• HTTP transport. The attacker must be able to manipulate plain HTTP traffic. HTTPS protects against an on-path attacker, but Canonical still recommends updating.
• Package installation. The attack only triggers when the system downloads and installs a .deb, for example during an update.

Snap packages are not affected, as they use a different package management system. The Debian security tracker lists fixed versions for Debian 12 and 13 as well.

Fixed versions

Versions of the apt package listed as fixed by Ubuntu and Debian as of 5 November 2026 (always check the official sources, which may be updated):

For Ubuntu 20.04, 18.04, 16.04 and 14.04, fixes are available through ESM with Ubuntu Pro (16.04 and 14.04 with the Legacy add-on).

What to do on Ubuntu and Debian servers

1. Inventory. List VPS, servers, VMs and workstations using APT, with release and provider. Ubuntu 22.04, 24.04 and 26.04 are affected in the default configuration.
2. Update with retries disabled. Canonical recommends temporarily setting Acquire::Retries to zero while installing the fix, so the flaw cannot be exploited during the update itself:

   sudo apt update && sudo apt upgrade -o Acquire::Retries=0

   If a full upgrade is not possible, update APT only:

   sudo apt update && sudo apt install -o Acquire::Retries=0 --only-upgrade '?source-package(^apt$)'

3. Check the installed version against the table:

   apt list --installed '?source-package(^apt$)'

4. Prefer HTTPS in your sources. In /etc/apt/sources.list and /etc/apt/sources.list.d/, replace http:// Ubuntu archive URLs with https:// and confirm that sudo apt update runs without errors: some community mirrors do not support HTTPS. It is a useful precaution, not a substitute for the patch.
5. Check automatic updates. With unattended-upgrades enabled (the default since Ubuntu 16.04) security fixes are normally applied within about 24 hours. Still verify the version and logs, especially on servers managed by third parties.
6. Suppliers and mirrors. Ask whoever runs your hosting, cloud images or internal mirrors whether systems are already updated and which APT sources they use.

We do not publish exploitation steps: the goal is to close exposure. For other recent server and web stack flaws, see our end-of-October overview.

Frequently asked questions

Is our Ubuntu VPS on Infomaniak affected?

If it runs Ubuntu 22.04 or later with the default configuration, yes: the apt package must be updated. Real-world risk depends on whether HTTP traffic to the mirrors can be manipulated, but the fix is simple and should be applied.

We already use HTTPS for repositories: is that enough?

HTTPS protects against an on-path attacker, but not against a malicious mirror. Canonical recommends installing the update in any case.

Are applications installed via snap at risk?

No. According to Canonical, snap uses a different package management system and is not affected by this vulnerability.

How does this differ from the OpenSSH issue on Alpine?

The OpenSSH bypass concerns musl systems without PAM, typically Alpine, and Ubuntu/Debian are out of scope. The APT flaw concerns Debian and Ubuntu specifically. They are two separate tasks.

Our approach

ElaraTeq Sagl helps SMEs and practices in Ticino inventory their servers, plan updates and configure VPS and hosting in Switzerland securely (hosting, consulting). To review your systems you can contact us.

Sources

• Ubuntu, CVE-2026-109518 APT vulnerability fixes available, 4 November 2026
• Ubuntu, CVE-2026-109518, 4 November 2026
• Ubuntu, USN-8996-1: APT vulnerability, 4 November 2026
• Debian, Security tracker CVE-2026-109518