CVE-2026-11386Disclosure

MEDIUMCVSS 9.0 · CRITICAL

Exploitation observed; activity peaked at 3 mentions and remains active

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed

Recommended action window: Immediate (within 24h)

NVD description

An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.

Back to dashboard

4.0/ 10 priority

Sources & remediation

Other references

https://ubuntu.com/security/CVE-2026-11386

Weakness type (CWE)

CWE-20

Priority

MEDIUM

Exploitation

ACTIVE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 1 classified signals
Patch or workaround signal is available
9 mentions across 5 observed days
Momentum state: stable

What's happening

Active exploitation reported across 1 signal
Patch or workaround mentioned in 4 signals
Technical details provided in 8 signals
Disclosure: 5 classified signals
Peaked 2d ago at 3 mentions (2026-07-18); latest day: 1
9 total mentions across 5 days

Deep dive

Activity timeline9 mentions / 5d

Signal classification3 categories

Disclosure

555.6%

Patch

333.3%

Active Exploitation

111.1%

Referenced assets6 URLs

By indicator

Classification over time

Date	Total	Labels

2026-07-16	2	Disclosure2
2026-07-17	1	Active Exploitation1
2026-07-18	3	Disclosure2Patch1
2026-07-20	2	Disclosure1Patch1
2026-07-21	1	Patch1

Full discourse9 posts

Daily CyberSecurity@Daily_CyberSec90d
Disclosure
Ubuntu Pro Client vulnerability CVE-2026-11386 (CVSS 9.0) lets a spoofed contract server inject APT sources and run code with root privileges. #Ubuntu #UbuntuPro #CVE202611386 #Canonical #RCE #Linux #CyberSecurity http://securityonline.info/ubuntu-pro-client-cve-2026-11386/
Post summary
The post announces CVE-2026-11386, giving its CVSS score and describing its impact as elevation to root via injected APT sources, but provides no PoC, exploit, or patch details.
01083718
12.9K followersView on X
yousukezan@yousukezan90d
Patch
Canonicalは7月16日、Ubuntu Pro Clientの重大な脆弱性CVE-2026-11386を修正するセキュリティ更新USN-8555-1を公開した。細工されたデータによりroot権限で任意のコードを実行される可能性がある。現時点で悪用や概念実証コードは確認されていない。この脆弱性はUbuntu Pro Clientが契約サーバーから取得したAPTソース設定を適切に検証せず書き込むことに起因する。directives.suites[]やdirectives.aptURLへ改行を含む細工されたデータを与えることで、攻撃者が任意のAPTリポジトリー設定を追加できる。また、additionalPackages[]の内容も検証されず、root権限で実行されるapt-get installへ渡されるため、不正なパッケージをインストールさせて任意コード実行につながる可能性がある。ただしCanonicalは攻撃の難易度は高く、契約サーバーの侵害や信頼された認証局を利用した通信の改ざんなどが必要としている。修正は26.04 LTS、24.04 LTS、22.04 LTSのほか、20.04 LTS以前のUbuntu Pro対応版で提供された。一方、サポート終了済みのUbuntu 25.10には修正は提供されない。USN-8555-1では、このほか認証トークン漏えいのCVE-2026-9494と、ログ収集時のシンボリックリンク処理の問題であるCVE-2026-12391も修正している。 https://securityonline.info/ubuntu-pro-client-cve-2026-11386/
Post summary
Canonical released USN‑8555‑1 to patch CVE‑2026‑11386, a flaw that could allow root code execution via forged APT source settings; no exploitation or PoC has been observed.
010731.9K
14.9K followersView on X
kokumօtօ@__kokumoto87d
Disclosure
Ubuntu Pro Clientに権限昇格の脆弱性。CVE-2026-11386はCVSSスコア9.0で、コンタクトサーバからのAPTソースファイル取得時に改行コードが注入可能で、なりすまりしによりコード実行が可能。公式評価では複雑製は高い。 https://securityonline.info/ubuntu-pro-client-cve-2026-11386/
Post summary
CVE‑2026‑11386 is a high‑severity (CVSS 9.0) privilege‑escalation vulnerability in Ubuntu Pro Client that exploits newline injection in APT source file retrieval, enabling code execution, with no patches or exploits yet reported.
00020950
7.8K followersView on X
Jangra@jxngrx87d
Patch
🚨 Ubuntu users, especially if you're running servers or cloud workloads, check this. A critical vulnerability (CVE-2026-11386, CVSS 9.0) has been disclosed in Ubuntu Pro Client. What's at risk? • Root Remote Code Execution • Affects Ubuntu LTS releases from 14.04 → 26.04 • Ubuntu Pro Client is preinstalled on Ubuntu Server and many Ubuntu Pro cloud images There's no public exploit yet. That's exactly why now is the best time to patch. Run: apt update && apt upgrade
Post summary
A critical CVE-2026-11386 affecting Ubuntu Pro Client has been disclosed; the advisory urges users to apply updates immediately via apt.
0001050
594 followersView on X
Orca Security@orcasec88d
Patch
New CVE, same question: what's actually exposed? CVE-2026-11386 (CVSS 9.0) can give attackers root on Ubuntu Pro Client systems via a spoofed contract server response. Patch fast. Knowing what's reachable first is what saves you the scramble. https://orca.security/resources/blog/ubuntu-pro-client-vulnerability-cve-2026-11386/?utm_source=twitter&utm_medium=organic+social&utm_campaign=orca+blog https://t.co/TiGSSkKzb0
Post summary
The tweet announces CVE-2026-11386, a high‑severity vulnerability that allows root on Ubuntu Pro Client systems through a spoofed contract server response, and urges immediate patching.
00010161
4.8K followersView on X
Israel@f1tym190d
Disclosure
Canonical ubuntu-pro-client vulnerability CVE-2026-11386 allows arbitrary code execution with root privileges on affected Ubuntu releases https://ift.tt/NVrLO7q
Post summary
The text announces CVE-2026-11386, noting it allows arbitrary code execution with root privileges on certain Ubuntu releases.
0000067
1.0K followersView on X
VulDB 🛡@vuldb91d
Active Exploitation
Some increased actor activities are shown targeting Canonical ubuntu-pro-client (CVE-2026-11386) https://vuldb.com/vuln/379514/cti
Post summary
The post indicates that threat actors are targeting CVE‑2026‑11386 on Canonical ubuntu‑pro‑client, suggesting active exploitation, but it provides no details on the vulnerability, exploit, or remediation.
00000100
2.3K followersView on X
MalwareObserver@MalwareObserver92d
Disclosure
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-11386](https://ubuntu.com/security/CVE-2026-11386) An input validation and injection vu... https://ubuntu.com/security/CVE-2026-11386 #PatchManagement #Vulnerability #CVE
Post summary
The post announces CVE‑2026‑11386, an input validation and injection vulnerability, and references the Ubuntu security page and a patch‑management hashtag, indicating a vendor advisory and patch are available.
0000032
11 followersView on X
Upwind Security MDR@UpwindMDR92d
Disclosure
🚨 CRITICAL - Ubuntu Pro Client contract response injection to root APT sources + package install (CVE-2026-11386) Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) improperly uses unescaped str.format() on contract server response fields when generating root-owned APT source files, enabling attacker-controlled deb line injection via newlines. The root cause is improper input validation/escaping leading to newline injection and unsafe command argument construction for package installation. An attacker who can spoof, intercept, or tamper with the Ubuntu Pro contract service response can inject additional APT configuration and abuse the unvalidated additionalPackages[] field to drive a root-executed apt-get install of attacker-chosen packages. If exploited, this can result in arbitrary code execution as root and full system compromise, especially on Ubuntu Server and cloud Ubuntu Pro images that auto-attach by default. 👉 Affected: ubuntu-pro-client / ubuntu-advantage-tools (versions using contract-driven APT source generation + additionalPackages[] install path) | Upgrade to No fix yet — treat as suspicious
Post summary
The announcement highlights a root‑execution vulnerability in ubuntu‑pro‑client stemming from unescaped formatting, but no PoC, exploit tool, or active exploitation is mentioned, and no fixes are yet available.
0000091
254 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-11386

yousukezan[verified]@yousukezanPatch

Canonical released USN‑8555‑1 to patch CVE‑2026‑11386, a flaw that could allow root code execution via forged APT source settings; no exploitation or PoC has been observed.

kokumօtօ[verified]@__kokumotoDisclosure

CVE‑2026‑11386 is a high‑severity (CVSS 9.0) privilege‑escalation vulnerability in Ubuntu Pro Client that exploits newline injection in APT source file retrieval, enabling code execution, with no patches or exploits yet reported.

Jangra[verified]@jxngrxPatch

A critical CVE-2026-11386 affecting Ubuntu Pro Client has been disclosed; the advisory urges users to apply updates immediately via apt.

Israel[verified]@f1tym1Disclosure

The text announces CVE-2026-11386, noting it allows arbitrary code execution with root privileges on certain Ubuntu releases.

MalwareObserver[verified]@MalwareObserverDisclosure

The post announces CVE‑2026‑11386, an input validation and injection vulnerability, and references the Ubuntu security page and a patch‑management hashtag, indicating a vendor advisory and patch are available.

Upwind Security MDR[verified]@UpwindMDRDisclosure

The announcement highlights a root‑execution vulnerability in ubuntu‑pro‑client stemming from unescaped formatting, but no PoC, exploit tool, or active exploitation is mentioned, and no fixes are yet available.

Daily CyberSecurity@Daily_CyberSecDisclosure

The post announces CVE-2026-11386, giving its CVSS score and describing its impact as elevation to root via injected APT sources, but provides no PoC, exploit, or patch details.

Orca Security@orcasecPatch

The tweet announces CVE-2026-11386, a high‑severity vulnerability that allows root on Ubuntu Pro Client systems through a spoofed contract server response, and urges immediate patching.