# APT: update hosts and rebuild affected images Canonical: https://www.oktsec.com/radar/apt-cve-2026-109518 Publisher: Oktsec Language: en Published: 2026-11-07T12:52:55Z Updated: 2026-11-07T12:52:55Z Record reviewed: 2026-11-07T12:52:55Z Latest evidence check: 2026-11-07T12:52:55Z Disclosed: 2026-11-04 APT can install unverified packages when an attacker can intercept HTTP downloads under retry conditions. Distribution fixes are available; AWS says to update running hosts without waiting for refreshed images. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Review this week - Rationale: HTTP package sources, retries and an attacker on the network path can expose package installation. The notices do not establish active attacks. - Evidence: Attacks not established - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: APT - Products: APT on Ubuntu and Debian - CVEs: CVE-2026-109518 ## Technical overview The flaw involves redirects, retries and hard links during package downloads. A substituted package can run installer scripts with elevated privileges. HTTPS package sources reduce exposure but do not replace the APT update. Refreshed AWS image dates are forecasts, not a reason to delay patching. ## Recommended response Update APT on affected hosts. For affected containers, rebuild images with the fixed package and redeploy. Relevant to: Ubuntu and Debian administrators. ## Affected systems and fixes ### Ubuntu 22.04 Affected: APT packages preceding the branch correction. Fixed release / action: 2.4.15ubuntu0.1 ### Ubuntu 24.04 Affected: APT packages preceding the branch correction. Fixed release / action: 2.8.4ubuntu0.1 ### Ubuntu 26.04 Affected: APT packages preceding the branch correction. Fixed release / action: 3.2.1ubuntu0.1 ### Ubuntu 26.10 Affected: APT packages preceding the branch correction. Fixed release / action: 3.3.3ubuntu0.1 ### Other Ubuntu and Debian branches Affected: Check distribution support and the package advisory. Fixed release / action: Use USN-8996-1 or Debian DSA-6607-1; older Ubuntu branches may require Ubuntu Pro. Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.04 Checked: 2026-11-05T12:14:16.442Z No matching CVE appears in the reviewed catalog snapshot. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-07T13:37:50.242Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-109518](https://api.first.org/data/v1/epss?cve=CVE-2026-109518): 0.93% probability of observed exploitation in the next 30 days; percentile 60.72%; score date 2026-11-06. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-07T13:37:50.242Z. ## Response checklist 1. **Update existing hosts** — Follow AWS guidance with Acquire::Retries=0 during the update; confirm the installed APT version. 2. **Update future deployments** — Rebuild images and redeploy containers. Changing a launch image alone does not patch running hosts. ## Relevance to AI environments Include build runners and hosts used by AI workloads; this is not specific to agents. ## Sources - [Ubuntu USN-8996-1](https://ubuntu.com/security/notices/USN-8996-1) — Canonical; Vendor notice; checked 2026-11-07T12:52:55Z - [AWS 2026-172](https://aws.amazon.com/security/security-bulletins/2026-172-aws/) — AWS; Vendor notice; checked 2026-11-07T12:52:55Z ## Editorial record - 2026-11-07T12:52:55Z: Added vendor scope, corrections and response guidance. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/apt-cve-2026-109518) · [Build a response plan](https://www.oktsec.com/radar/apt-cve-2026-109518#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=apt-cve-2026-109518&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=apt-cve-2026-109518&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.