Debian APT flaw CVE-2026-109518 lets attackers hijack updates and run code as root
VULNERABILITYCVE-2026-109518redteam/daily · 1 source
- Severity
- High
- Highest CVSS
- 7.7
- Exploited
- Not known
- Sources
- 1
What happened
CVE-2026-109518 is a flaw in APT that can let a man-in-the-middle replace a verified package during an interrupted, redirected download, leading to code execution as root. It requires the attacker to sit on the network path and APT's Acquire::Retries setting to be above zero, which is 3 by default on Debian 12 and Ubuntu 22.04 LTS. Debian's fixes are APT 2.6.2 for bookworm and 3.0.4 for trixie, and Ubuntu and other derivatives need their own patches.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Upgrade APT to 2.6.2 on bookworm or 3.0.4 on trixie, and check that the installed version matches the fixed one for your release.
- Run apt update and apt upgrade only on trusted networks.
- Avoid untrusted mirrors and proxies until your system is patched.
- On unpatched systems, consider setting Acquire::Retries to 0, though this can make updates less reliable on poor connections.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 2 updates
Who reported · 1 outlet
Cyber Security News