Debian APT: RCE

Debian APT

A vulnerability in the APT package manager allows a man-in-the-middle attacker to replace a package, potentially leading to remote code execution.

Do this now

Check the advisory for a fix and restrict access to APT meanwhile.

First seen: 4 Nov 2026
Last update: 4 Nov 2026, 22:17 UTC
Versions per the CVE record from canonical, not the vendor: 3.3.6
3.3.3ubuntu0.1
3.2.1
3.0.4
2.8.4
2.6.2
2.4.15
2.2.5
2.0.12
1.8.2.4
1.6.19
1.4.12
1.2.36
1.0.1ubuntu2.24+esm4
Identifiers: CVE-2026-109518
CVSS: 7.7
Source: news

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Debian APT: RCE
Severity: high. Patch status: fix status unknown.
Affected: Debian APT
Versions per the CVE record from canonical, not the vendor: 3.3.6, 3.3.3ubuntu0.1, 3.2.1, 3.0.4, 2.8.4, 2.6.2, 2.4.15, 2.2.5, 2.0.12, 1.8.2.4, 1.6.19, 1.4.12, 1.2.36, 1.0.1ubuntu2.24+esm4
Ids: CVE-2026-109518

A vulnerability in the APT package manager allows a man-in-the-middle attacker to replace a package, potentially leading to remote code execution.

## Steps
1. Search the repo, its CI and infra config for Debian APT. If present, report the version in use and whether it's affected.
2. Versions per the CVE record from canonical, not the vendor: APT: 3.3.6; 3.3.3ubuntu0.1; 3.2.1; 3.0.4; 2.8.4; 2.6.2; 2.4.15; 2.2.5; 2.0.12; 1.8.2.4; 1.6.19; 1.4.12; 1.2.36; 1.0.1ubuntu2.24+esm4. Don't treat them as a fix until the vendor says so. APT <= 1.8.5: the CVE record names no fix; check the vendor advisory before assuming there is none. Until one ships: restrict network access to it.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| APT | per the CVE record from canonical, not the vendor | 3.3.6 | restrict network access to it |
| APT | per the CVE record from canonical, not the vendor | 3.3.3ubuntu0.1 | restrict network access to it |
| APT | per the CVE record from canonical, not the vendor | 3.2.1 | restrict network access to it |
| APT | per the CVE record from canonical, not the vendor | 3.0.4 | restrict network access to it |
| APT | per the CVE record from canonical, not the vendor | 2.8.4 | restrict network access to it |
| APT | per the CVE record from canonical, not the vendor | 2.6.2 | restrict network access to it |
| APT | per the CVE record from canonical, not the vendor | 2.4.15 | restrict network access to it |
| APT | per the CVE record from canonical, not the vendor | 2.2.5 | restrict network access to it |
| APT | per the CVE record from canonical, not the vendor | 2.0.12 | restrict network access to it |
| APT <= 1.8.5 | not named in the CVE record | check the vendor advisory: https://lists.debian.org/debian-security-announce/2026/msg00526.html | restrict network access to it |
| APT | per the CVE record from canonical, not the vendor | 1.8.2.4 | restrict network access to it |
| APT | per the CVE record from canonical, not the vendor | 1.6.19 | restrict network access to it |
| APT | per the CVE record from canonical, not the vendor | 1.4.12 | restrict network access to it |
| APT | per the CVE record from canonical, not the vendor | 1.2.36 | restrict network access to it |
| APT | per the CVE record from canonical, not the vendor | 1.0.1ubuntu2.24+esm4 | restrict network access to it |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2026-109518") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://thehackernews.com/2026/11/debian-and-ubuntu-apt-flaw-lets-mitm.html https://seclists.org/oss-sec/2026/q4/519
https://pwned.coffee/i/debian-apt-rce-cve-2026-109518

Timeline

4 Nov 2026, 22:17 UTC
Fix status: patched → unknown.
4 Nov 2026
First reported.

Receipt

Exploitation: No known exploitation
By release line, per the CVE record from canonical, not the vendor: Product Affected Version named Source
APT before 3.3.6 3.3.6 CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT before 3.3.3ubuntu0.1 3.3.3ubuntu0.1 CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT before 3.2.1 3.2.1 CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT before 3.0.4 3.0.4 CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT before 2.8.4 2.8.4 CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT before 2.6.2 2.6.2 CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT before 2.4.15 2.4.15 CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT before 2.2.5 2.2.5 CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT before 2.0.12 2.0.12 CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT <= 1.8.5 fix not named in the CVE record: see vendor advisory CVE record (CNA) checked 4 Nov
APT before 1.8.2.4 1.8.2.4 CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT before 1.6.19 1.6.19 CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
The CVE record names no fix for one line; the vendor’s advisory may: lists.debian.org
Score: CVSS 7.7 (high). CVSS 4.0 7.7 (CNA canonical) for CVE-2026-109518
Last checked: 4 Nov 2026, 23:18 UTC

Product	Affected	Version named	Source
APT	before 3.3.6	3.3.6	CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT	before 3.3.3ubuntu0.1	3.3.3ubuntu0.1	CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT	before 3.2.1	3.2.1	CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT	before 3.0.4	3.0.4	CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT	before 2.8.4	2.8.4	CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT	before 2.6.2	2.6.2	CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT	before 2.4.15	2.4.15	CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT	before 2.2.5	2.2.5	CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT	before 2.0.12	2.0.12	CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT	<= 1.8.5	fix not named in the CVE record: see vendor advisory	CVE record (CNA) checked 4 Nov
APT	before 1.8.2.4	1.8.2.4	CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov
APT	before 1.6.19	1.6.19	CVE record (CNA) per the CVE record from canonical, not the vendor checked 4 Nov

Sources: KEV – CVE record ✓ Vendor –

Sources

Totalone hot coffee