Debian APT CVE-2026-109518

Exploitation requires an on-path adversary able to manipulate HTTP traffic between the APT client and the archive server - a malicious or compromised mirror, a hostile proxy, or active MITM. It further requires (1) a user or automation to trigger a package install, (2) the download to be redirected and then retried, which the attacker must induce, and (3) the client to have Acquire::Retries set to a non-zero value. That retry setting defaults to 3 only starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish); older releases in their default configuration are NOT exploitable. These factors - mandatory on-path position, dependence on an install event and redirect/retry flow, and the version-gated default setting - are the concrete limits defenders should weigh against the root-level RCE impact.

This is a genuine high-priority issue for Debian/Ubuntu fleets but with meaningful preconditions that keep it below 'drop everything' urgency. The vuln.today decision label is 'this_week', consistent with a serious but conditional network flaw rather than an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P, VC:H/VI:H/VA:H, score 7.7) signals an unauthenticated network attack that nonetheless carries an attack requirement (AT:P) and passive user interaction (UI:P) - the attacker needs an on-path position (malicious mirror, proxy, or traffic interception) and must wait for a user/automation-triggered package install, so this is not a spray-and-pray remote exploit. No EPSS score is provided in the input, and the CVE is NOT on CISA KEV, so there is no public-infrastructure signal of mass exploitation; exploitation status is best described as no public exploit identified at time of analysis. No SSVC/automatable field was supplied. The net picture: a real priority to patch because the impact is root RCE on a ubiquitous tool, tempered by the fact that it requires an on-path adversary, a package-install trigger, and a non-default-on-older-releases retry setting (Acquire::Retries != 0, which is the default only on Debian 12 / Ubuntu 22.04 and later). Older releases in default configuration are not exploitable, which narrows the real-world blast radius.

An attacker who controls a network path between an APT client and its archive mirror - for example a malicious or compromised mirror, a hostile proxy, or an on-path MITM on untrusted WiFi - waits for the client to run a package install. By abusing APT's reuse of hard links during a redirect-and-retry download sequence, the attacker substitutes an unverified attacker-controlled package, which APT installs and executes with root privileges. No public exploit was identified in the provided intelligence; the attack also depends on the client having Acquire::Retries set to a non-zero value (the default on Debian 12 and Ubuntu 22.04 and later).