Ubuntu has issued updates to address a vulnerability in the APT package manager that could allow an attacker to obtain root access through a man-in-the-middle attack.
The flaw, identified as CVE-2026-109518, affects how APT handles package downloads over HTTP. An attacker able to intercept and modify traffic between a vulnerable system and the archive server can substitute legitimate packages with malicious .deb files.
Successful exploitation requires the client to retry a previously failed download. Ubuntu notes that this retry behavior is disabled by default on Ubuntu 22.04 LTS (Jammy Jellyfish) and newer releases, making the vulnerability unexploitable under standard conditions on those versions.
Debian released patches for the same issue prior to Ubuntu. Use of HTTPS with TLS provides additional protection because the attack depends on the ability to manipulate unencrypted HTTP traffic.
Although package signatures should normally block installation of tampered files, the vulnerability enables APT to proceed with installing the malicious package even when signature verification fails. Any scripts contained in the .deb package then execute with root privileges, which can result in complete system compromise.
