Ubuntu Releases Fix for APT Vulnerability CVE-2026-109518; Administrators Should Run apt upgrade Promptly
Ubuntu has shipped a fix for the APT package-manager vulnerability CVE-2026-109518. The flaw sits in an on-path HTTP attack scenario, allowing an attacker to intervene during package transfer and ultimately obtain root privileges. Ubuntu's advisory lists a CVSS 4.0 score of 7.7, with the attack vector string AV:N/AC:L/AT:P/PR:N/UI:P (full vector available in the Ubuntu advisory).
Affected releases span from Trusty 14.04 through Resolute 26.04 LTS, as well as Stonking 26.10. The fixed APT package version differs per release; for example:
- Jammy 22.04 LTS: APT 2.4.15ubuntu0.1
- Noble 24.04 LTS: APT 2.8.4ubuntu0.1
Note that on Stonking 26.10, the fix (APT 3.3.3ubuntu0.1) is still being published rather than fully available, so users of that release should check back once the package lands in the archive.
Administrators should check the package version matching the release they have deployed before upgrading. Ubuntu recommends carrying the Acquire::Retries=0 option during the upgrade — that is, adding -o Acquire::Retries=0 to the command, or setting Acquire::Retries to 0 in the configuration — noting that this setting provides a mitigation while the update is being installed:
sudo apt update
sudo apt upgrade -o Acquire::Retries=0
Why the APT Vulnerability Deserves Priority
APT sits upstream in the trust chain: nearly all software installed, updated and patched on an Ubuntu system depends on this toolset and its package-transfer mechanism. In other words, when APT itself breaks, what is affected is not a single package but the channel for "receiving every other fix." The attack surface of this vulnerability lies precisely along that channel — an attacker intervening in HTTP transfers on-path can inject content into the installation flow and end up with root privileges, which is why flaws like this should not be taken lightly.
Ubuntu also offers a mitigation path: switching to HTTPS/TLS repositories lowers the risk of transfer interception. The advisory further notes that snap packages and FTP are unaffected; if unattended-upgrades is enabled on the host, security fixes are typically applied automatically within 24 hours.
Reminders for Operations Teams
For teams managing multiple Ubuntu hosts, this incident has three operational implications:
- Prioritise
apt upgradewith-o Acquire::Retries=0in this maintenance window. That the fix has shipped indicates upstream judged a code change to be warranted; the update is low-cost and reversible, so applying it early outweighs waiting for further analysis. - Confirm that the automatic update policy (unattended-upgrades) covers security updates, and check the related logs to avoid hosts lingering in an unpatched state due to policy configuration; at the same time, follow the advisory's guidance and prefer HTTPS/TLS repositories.
- Track Ubuntu security advisories to cross-check the fixed package version matching your deployed release and the CVSS data, and use that to adjust vulnerability-scanning and compliance baselines.
For fix and advisory details, see the Ubuntu official blog and security advisory pages.
What This Means for Hong Kong Readers
Package managers are routinely treated as an assumed utility of the operating system; this advisory is a reminder that they themselves should be part of asset inventory and threat monitoring, not just an entry in an "installed software" list. Ubuntu-based servers and workstations in Hong Kong — whether deployed within organisations or by individual users — are equally affected by this advisory; this article does not speak for any local organisation's response measures, and readers can check host status according to their own maintenance processes and follow up on Ubuntu's subsequent advisories.
(This article is written based on Ubuntu's official release; for fixed package versions per release, CVSS 4.0 score and attack vector details, refer to the Ubuntu security advisory.)
Ubuntu 釋出 APT 漏洞 CVE-2026-109518 修補，管理員應儘速執行 apt upgrade
Ubuntu 已發布修補程式，處理 APT 套件管理器漏洞 CVE-2026-109518。該漏洞屬 on-path（中間人）HTTP 攻擊情境，攻擊者有機會在套件傳輸過程中介入，最終取得 root 權限。Ubuntu 公告列出的 CVSS 4.0 評分為 7.7，攻擊向量字串為 AV:N/AC:L/AT:P/PR:N/UI:P（完整字串見 Ubuntu 公告）。
受影響的發行版本由 Trusty 14.04 一直涵蓋至 Resolute 26.04 LTS，以及 Stonking 26.10。各版本的已修補 APT 套件版本不同，例如：
- Jammy 22.04 LTS： APT 2.4.15ubuntu0.1
- Noble 24.04 LTS： APT 2.8.4ubuntu0.1
需留意的是，Stonking 26.10 的修補程式（APT 3.3.3ubuntu0.1）仍在發布中，尚未完全可用；該版本用戶應待套件正式收錄至軟件庫後再行查核。
管理員應按所部署的發行版本核對對應的套件版本，再執行升級。Ubuntu 建議在升級時帶上 Acquire::Retries=0 參數（即於指令加上 -o Acquire::Retries=0，或在設定中將 Acquire::Retries 設為 0），並指出此設定可在安裝更新時提供緩解：
sudo apt update
sudo apt upgrade -o Acquire::Retries=0
為何 APT 漏洞需要優先處理
APT 位於整條信任鏈的上游：Ubuntu 系統上幾乎所有安裝、更新及修補的軟件，都依賴這組工具與它的套件傳輸機制。換言之，一旦 APT 本身出問題，受影響的不是單一套件，而是「接收所有其他修補程式」的管道。此漏洞的攻擊面正是在這條管道之上——攻擊者以 on-path 方式介入 HTTP 傳輸，便可向安裝流程植入內容並最終取得 root 權限，這正是此類漏洞不能等閒視之的原因。
Ubuntu 同時給出緩解方向：改用 HTTPS／TLS 軟件源（repositories）可降低傳輸被截取的風險。公告並註明，snap 套件與 FTP 均不受此漏洞影響；若主機已啟用 unattended-upgrades，安全性修補通常會在 24 小時內自動套用。
給營運團隊的提醒
對負責多台 Ubuntu 主機的團隊而言，此事的作業意義有三點：
- 把帶上
-o Acquire::Retries=0的apt upgrade納入本輪維護窗口的優先項目。 修補程式既已發布，代表上游判斷程式碼變更有其必要；更新成本低且可回退，先套用比等待進一步分析更划算。 - 確認自動更新政策（unattended-upgrades）確實涵蓋安全性更新，並檢查相關日誌，避免主機因政策設定而長期滯留在未修補狀態；同時按公告指引，優先使用 HTTPS／TLS 軟件源。
- 追蹤 Ubuntu 安全公告，核對所部署版本對應的已修補套件版本與 CVSS 資料，據此調整漏洞掃描與合規基線。
相關修補與公告細節，可參閱 Ubuntu 官方網誌與安全公告頁面。
對香港讀者的意義
套件管理器平日被當作理所當然的作業系統工具，這次公告提醒的是：它本身也應納入資產盤點與威脅監控的範圍，而不只是列在「已安裝軟件」清單裡。本港使用 Ubuntu 的伺服器與工作站環境——不論是機構內部部署還是個人用戶——都同樣受此公告影響；本文不代述任何本地機構的應變措施，讀者可按自身維護流程核對主機狀態並跟進 Ubuntu 的後續公告。
（本文依 Ubuntu 官方公布內容撰寫；各發行版本的已修補套件版本、CVSS 4.0 評分與攻擊向量詳情，以 Ubuntu 安全公告為準。）