APT and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
APT has a flaw rated critical -- the kind of severity that moves a fix from the to-do list to today's priority.
A flaw in APT , the package manager for APT and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own.
The attacker's code then runs as root, according to advisories that APT , Ubuntu , and APT's developers published on November 4.
APT has released fixed versions of APT for the flaw, CVE-2026-109518 , and aPT's developers, who call the flaw critical, say updates for Ubuntu and its Ubuntu Pro subscription service are being released.
Ubuntu rates the flaw as high priority, with a CVSS 4.0 score of 7.7, and says that distributions built on APT and Ubuntu are affected as well, without naming any.
The attacker can be anyone who can change the HTTP traffic between APT and the package server, including a malicious mirror or proxy, according to Ubuntu.
Older releases, such as APT 11 and Ubuntu 20.04, are not exposed by default, according to Ubuntu; they describe the attack over HTTP and do not say whether package sources reached over HTTPS are exposed.
Ubuntu published new APT builds for four of its releases to its security archive at 14:25 UTC on November 4: At 15:46 UTC, Ubuntu still marked all eight releases it tracks for the flaw, from 14.04 LTS to 26.10, as vulnerable.
None of the three advisory reports describe attacks exploiting the flaw or offer a workaround for systems that cannot update yet; for APT 11, whose APT long-term support ended on August 31 , APT's developers have published a fixed version, 2.2.5.
But many user scripts may have turned on the retry setting, Acquire::Retries, on those releases anyway, APT's developers say.
The attack needs APT to retry failed downloads, which it does by default from APT 12 and Ubuntu 22.04 onward.
What happened
A flaw in APT, the package manager for APT and Ubuntu, enables an attacker who can modify package downloads to replace a verified package with their own.
The attacker's code then executes with root privileges, as stated in advisories released by APT, Ubuntu, and APT's developers on November 4.
What changed
APT has issued patched versions to address the flaw, CVE-2026-109518, and APT's developers, who classify the flaw as critical, are rolling out updates for Ubuntu and its Ubuntu Pro subscription service.
Who is affected
Ubuntu considers the flaw a high priority, assigning it a CVSS 4.0 score of 7.7, and notes that distributions built on APT and Ubuntu are also affected, though specific names are not provided.
The attacker could be anyone capable of altering the HTTP traffic between APT and the package server, including a malicious mirror or proxy, according to Ubuntu.
Why it matters
According to Ubuntu, older releases like APT 11 and Ubuntu 20.04 are not vulnerable by default; they detail the attack over HTTP but do not clarify whether package sources accessed over HTTPS are at risk.
Technical details
Ubuntu published new APT builds for four of its releases to its security archive at 14:25 UTC on November 4. As of 15:46 UTC, Ubuntu still classified all eight releases it tracks for the flaw, from 14.04 LTS to 26.10, as vulnerable.
None of the three advisory reports outline attacks that exploit the flaw or provide a workaround for systems that cannot update yet. For APT 11, which reached the end of its long-term support on August 31, APT's developers have released a fixed version, 2.2.5.
Response
APT's developers note that many user scripts may have enabled the retry setting, Acquire::Retries, on those releases.
Attribution
The Hacker News: A flaw in APT , the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own.
What to watch next
Watch for updated vendor guidance and fixed-version details.