CVE-2026-109518
APT RCE via hard link reuse
CVSS score
7.7
EPSS probability
—
Risk score
0.8
Published
3 h ago
Related Security News
Articles and analysis bulletins in which the press and security publications have covered this vulnerability:
Debian and Ubuntu APT Flaw Lets MitM Attackers Swap Verified Packages and Run Code as Root
A flaw in APT, the package manager for Debian and Ubuntu, allows an attacker who can modify package downloads to swap a checked package for their own. The attacker's code then runs as root, according to advisories that Debian, Ubuntu, and APT's developers published on November 4. The attack needs APT to retry failed downloads, which it does by default from Debian 12 and
Similar Vulnerabilities
10.0
CVE-2021-44228 Actively exploitedImproper input validation in Apache Log4j
Patch verified Public Exploits:33EPSS %100
10.0
CVE-2015-3306 Actively exploitedImproper access control in N/a
Workaround Public Exploits:19EPSS %99
9.8
CVE-2020-1938 Actively exploitedVulnerability in Apache Tomcat
Patch verified Public Exploits:20EPSS %99
9.8
CVE-2022-30333 Actively exploitedPath traversal in N/a
Patch verified Public Exploits:5EPSS %99
9.8
CVE-2026-24061 Actively exploitedVulnerability in GNU Inetutils
Patch verified Public Exploits:24EPSS %99
9.8
CVE-2012-0507 Actively exploitedVulnerability in N/a
Partial patch Public Exploits:1EPSS %98
Get this vulnerability through the API
Affected products, version ranges, exploitation status and patch information in a single request, with a free key.
curl -H "x-api-key: $DAYBREACH_API_KEY" \ "https://api.daybreach.dev/api/v1/intel/cves/CVE-2026-109518"