Is CVE-2026-11386 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11386 being exploited in the wild.

How severe is CVE-2026-11386?

Critical severity, with a CVSS score of 9, published 16 July 2026.

Which products and versions are affected?

Canonical Ubuntu < 37.3; Canonical Ubuntu-Pro-Client < 37.3.

Is there a fix for CVE-2026-11386?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11386 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-11386?

Check whether you run Canonical Ubuntu or Canonical Ubuntu-Pro-Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11386: Canonical ubuntu-pro-client code execution via APT source injection

Q: Which products and versions are affected?

Canonical Ubuntu < 37.3; Canonical Ubuntu-Pro-Client < 37.3.

Q: Is there a fix for CVE-2026-11386?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-11386 attacked?

It is attacked over the network, in an operating system.

Q: Am I affected by CVE-2026-11386?

Check whether you run Canonical Ubuntu or Canonical Ubuntu-Pro-Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11386 · Severity: critical · CVSS 9 · Published 2026-07-16

A vulnerability in the Ubuntu Pro client, a tool preinstalled on Ubuntu Server and cloud images, could allow an attacker to take full control of a system. By manipulating the data sent from a contract server, an attacker can force the system to install malicious software with administrative privileges. This could lead to complete system compromise, data theft, or permanent service disruption.

Technologies: Canonical Ubuntu, Canonical Ubuntu-Pro-Client. Vendors: Canonical.

Quick answers

Is CVE-2026-11386 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11386 being exploited in the wild.
How severe is CVE-2026-11386?: Critical severity, with a CVSS score of 9, published 16 July 2026.
Which products and versions are affected?: Canonical Ubuntu < 37.3; Canonical Ubuntu-Pro-Client < 37.3.
Is there a fix for CVE-2026-11386?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11386 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-11386?: Check whether you run Canonical Ubuntu or Canonical Ubuntu-Pro-Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An input validation and injection vulnerability exists in the Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client uses Python's str.format() to construct APT source files from data received via the directives.suites[] and directives.aptURL fields without proper escaping or newline filtering. An attacker capable of manipulating the contract response (via intercepted connections or compromised infrastructure) can inject arbitrary deb configuration lines. When combined with the unvalidated additionalPackages[] field passed to a root-executed apt-get install command, this allows for the installation of malicious packages and arbitrary code execution as root. The issue is fixed in version 37.3 and corresponding backported versions for Ubuntu LTS releases.

Affected products

Canonical ubuntu-pro-client < 37.3
Canonical Ubuntu 26.04 LTS < 37.2ubuntu0.1
Canonical Ubuntu 24.04 LTS < 37.2ubuntu~24.04.1
Canonical Ubuntu 22.04 LTS < 37.2ubuntu~22.04.1

Timeline

2026-07-16: disclosed
2026-07-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.