APT flaw lets attackers swap packages and run code as root

A flaw in APT, the package manager used by Debian and Ubuntu, could let an attacker who can modify package downloads swap a verified package for their own, with the malicious code then running with root privileges. The issue hinges on APT retrying failed downloads by default (Acquire::Retries) and using HTTP traffic between APT and the package server to perform the attack via redirects and ordinary temporary errors.

Debian, Ubuntu, and APT developers describe the flaw as critical and have issued advisories on 4 November 2026; the CVE identifier is CVE-2026-109518. Debian notes that the vulnerability affects APT versions prior to the fixed release, and Ubuntu’s advisory indicates affected distributions as well, with updates forthcoming for Ubuntu and its Ubuntu Pro service; Ubuntu Pro users of Ubuntu 14.04 can already obtain a fix. The vulnerability is tied to the retry feature available on Debian 12 and Ubuntu 22.04 onward, though older releases are not exposed by default.

Evidence and affected versions are laid out by the maintainers. Debian reports that its testing branch still contained vulnerable APT version 3.3.5 at 14:58 UTC on 4 November 2026, while Debian 11 has a fixed version, 2.2.5. Debian’s advisory pairs with Ubuntu’s, which lists new APT builds for four releases released to its security archive at 14:25 UTC on 4 November 2026: Ubuntu 26.10 (3.3.3ubuntu0.1), Ubuntu 26.04 LTS (3.2.1ubuntu0.1), Ubuntu 24.04 LTS (2.8.4ubuntu0.1), and Ubuntu 22.04 LTS (2.4.15ubuntu0.1).

By 15:46 UTC, Ubuntu had marked all tracked releases as vulnerable. The attacker could be any entity able to alter HTTP traffic between APT and the package server, including a malicious mirror or proxy, with the exploit occurring when a package is installed. The advisories do not describe an exploit in the wild nor provide a workaround for systems unable to update immediately.