APT CVE-2026-109518 — on-path package substitution and root execution

Threat Overview

An on-path actor or malicious mirror may interfere with HTTP downloads and retries to substitute an unverified .deb, whose maintainer scripts run with root privileges. No unique network signature is published. This is relevant to MSSP customers because compromised externally exposed or trusted software components can enable privileged execution, credential theft or persistence. A matching behavioral signal is not by itself proof of this specific vulnerability.

References

– Vendor/research coverage (November 2026): https://ubuntu.com/blog/apt-vulnerability-fixes-available

Impacted Systems

Debian/Ubuntu and derivatives using APT with nonzero Acquire::Retries and package downloads vulnerable to on-path HTTP tampering. Default retries enabled on Debian 12+ and Ubuntu 22.04+. Debian 13 fixed apt 3.0.4, Debian 12 fixed apt 2.6.2; Ubuntu fixes are distribution-specific; consult current Canonical package status. Snap packages unaffected.

Why this matters

Targeted intelligence indicates a credible enterprise exposure or confirmed malicious activity. The queries below are designed for the specific telemetry that may be ingested into Sentinel.

Exploitation Status

Vendor advisories dated November 4 confirm the flaw and fixes; exploitation in the wild has not been confirmed.

What this hunt looks for

No customer workspace was queried. The hunt package defines searches for relevant available Microsoft Sentinel telemetry where the specified data source is ingested; it does not claim a completed review.

Required logs

Required data sources vary by query: Microsoft Sentinel CommonSecurityLog, Syslog, DeviceProcessEvents, DeviceFileEvents, and DeviceNetworkEvents where ingested. Query execution requires the corresponding tables and permissions.

P01 — APT package-manager processes and suspicious child execution

DeviceProcessEvents | where TimeGenerated >= ago(30d) | where InitiatingProcessFileName in~ ("apt","apt-get","dpkg","unattended-upgrade") | where FileName in~ ("sh","bash","dash","curl","wget","python3","perl","nc","socat") | project TimeGenerated,DeviceName,AccountName,InitiatingProcessFileName,FileName,ProcessCommandLine

P02 — APT download traffic to public IPs over HTTP

DeviceNetworkEvents | where TimeGenerated >= ago(30d) | where InitiatingProcessFileName in~ ("apt","apt-get","http","https") | where RemotePort == 80 and isnotempty(RemoteIP) | project TimeGenerated,DeviceName,InitiatingProcessFileName,RemoteIP,RemotePort,RemoteUrl,ActionType

P03 — New HTTP package destinations

let old=DeviceNetworkEvents | where TimeGenerated between (ago(30d)..ago(2d)) | where InitiatingProcessFileName in~ ("apt","apt-get") | summarize by DeviceId,RemoteIP; DeviceNetworkEvents | where TimeGenerated >= ago(2d) | where InitiatingProcessFileName in~ ("apt","apt-get") and RemotePort == 80 | join kind=leftanti old on DeviceId,RemoteIP | project TimeGenerated,DeviceName,RemoteIP,RemoteUrl,InitiatingProcessFileName

P04 — Unexpected deb package files created in temporary directories

DeviceFileEvents | where TimeGenerated >= ago(30d) | where FileName endswith ".deb" and (FolderPath startswith "/tmp/" or FolderPath startswith "/var/tmp/") | project TimeGenerated,DeviceName,FolderPath,FileName,InitiatingProcessFileName,ActionType

P05 — APT errors and download retries in syslog

Syslog | where TimeGenerated >= ago(30d) | where ProcessName has_any ("apt","dpkg","unattended") or SyslogMessage has_any ("apt-get","dpkg","package download") | where SyslogMessage has_any ("retry","redirect","hash sum mismatch","failed to fetch","download") | project TimeGenerated,Computer,ProcessName,SyslogMessage

P06 — Unusual outbound traffic from newly launched installer child

DeviceNetworkEvents | where TimeGenerated >= ago(30d) | where InitiatingProcessFileName in~ ("sh","bash","dash","python3","curl","wget") | where isnotempty(RemoteIP) and not(ipv4_is_private(RemoteIP)) | summarize Connections=count(),FirstSeen=min(TimeGenerated) by DeviceName,InitiatingProcessFileName,InitiatingProcessCommandLine,RemoteIP,RemotePort | order by FirstSeen desc

Detection Notes

No Sentinel log alone proves that a downloaded .deb was substituted. Linux process execution, package-management syslog, proxy and network telemetry are complementary; standard Syslog may not include apt install logs. The first query is the initial triage priority; follow-up queries require analyst correlation with affected-product inventory and normal administrative activity. Broad process/network queries can produce benign results.