APT Package Manager: Man-in-the-Middle Arbitrary Code Execution (CVE-2026-109518)
A critical vulnerability in the APT package manager allows man-in-the-middle attackers to perform package substitution and achieve root-level code execution by exploiting download retry logic.
CVE search metadata
CVE search record: CVE-2026-109518. KEV: no. Product: APT (Advanced Package Tool). Brief: APT Package Manager: Man-in-the-Middle Arbitrary Code Execution (CVE-2026-109518). Brief link: https://feed.craftedsignal.io/briefs/2026-11-apt-flaw/
Triage facts
Revision 1- Applicability
- APT (Advanced Package Tool)
- Evidence
- Unknown
- Severity
- Critical
- Action
- Immediate escalation
- Sources
- 1 public source
- Freshness
- Revision 1Nov 4, 20:11 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Likely
A critical vulnerability (CVE-2026-109518) in the Advanced Package Tool (APT) allows attackers to perform a man-in-the-middle (MitM) attack to swap legitimate packages for malicious ones. The attack is successful when APT attempts to retry a failed download, a process that occurs by default in Debian 12 and Ubuntu 22.04 or later, and potentially on earlier versions where users have explicitly enabled 'Acquire::Retries'. The malicious package executes with root privileges during the installation phase.
Impact
Successful exploitation allows an unprivileged attacker capable of intercepting or modifying network traffic (e.g., malicious mirror, proxy) to execute arbitrary code as root on the target system during package installation.
Recommendation
- Update APT to the patched versions provided by the vendor immediately.
- Audit system configuration files for the 'Acquire::Retries' setting in '/etc/apt/apt.conf.d/' or '/etc/apt/apt.conf'.
- Prioritize migration of legacy systems to supported distributions to ensure security patch availability.
Immediate actions
Patch APT on all Linux endpoints to the vendor-provided fixed versions.
Threat Hunt
Identify systems with non-standard package mirror configurations or high volumes of package retry activity.
Data: APT configuration files, System logs showing package manager network errors/retries
Mitigations
Upgrade APT to fixed versions identified in vendor bulletins (e.g., Ubuntu 22.04 LTS: 2.4.15ubuntu0.1).
CVE-2026-109518