CVE-2026-109518

Vendor

Debian, Canonical

Product

APT

CVSS v4.0

7.7 AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS

0.009 (p61)

Weakness

CWE-62, CWE-367

Exposure class

Operating system

Every item in the archive that references this CVE, highest rank first. Headlines open the publisher.

1. 45
   AWS bulletin AWS 4h ago

   CVE-2026-109518 - APT package manager that affects Ubuntu and Debian operating systems

   Bulletin ID: 2026-172-AWS Publication Date: 11/05/2026 20:00 PM PST Description: An issue in the APT package manager (CVE-2026-109518) affects Ubuntu and Debian operating systems. Under specific conditions, when APT is configured…

   Fix available CVE-2026-109518 Amazon Web Services Canonical
2. 27
   CVE NVD 40h ago

   On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or…

   On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can…

   CVSS 7.7 CVE-2026-109518 Debian Canonical