{"schemaVersion":3,"id":"USN-8555-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"ubuntu-advantage-tools vulnerabilities\n\nBilal Teke discovered that Ubuntu Advantage Tools exposed the Pro bearer\ntoken in command-line arguments when validating APT credentials. A local\nattacker could possibly use this issue to obtain sensitive information\nand gain unauthorized access to Ubuntu Pro repositories. (CVE-2026-9494)\n\nFrederick Jerusha discovered that Ubuntu Advantage Tools did not properly\nvalidate data received from the contract server when writing APT source\nfiles. An attacker could possibly use this issue to inject arbitrary APT\nconfiguration and execute arbitrary code. (CVE-2026-11386)\n\nMateusz Gierblinski discovered that Ubuntu Advantage Tools did not\nproperly handle symbolic links when collecting diagnostic logs. A local\nattacker could possibly use this issue to obtain sensitive information\nfrom files owned by the administrator. This issue only affected Ubuntu\n16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS,\nUbuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-12391)","dates":{"published":"2026-07-16T12:59:08.000Z","modified":"2026-07-16T21:16:21.242Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"ubuntu-advantage-tools","name":"ubuntu-advantage-tools","label":"ubuntu-advantage-tools","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/ubuntu-advantage-tools","purlType":"deb","versions":[{"text":"< 19.7ubuntu0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 37.1ubuntu0~16.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 37.1ubuntu0~18.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 37.1ubuntu0~20.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 37.2ubuntu~22.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 37.2ubuntu~24.04.1","noFixRecorded":false,"fixedIn":null},{"text":"< 37.2ubuntu0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.7ubuntu0.1 | < 37.1ubuntu0~16.04.1 | < 37.1ubuntu0~18.04.1 | < 37.1ubuntu0~20.04.1 | < 37.2ubuntu~22.04.1 | < 37.2ubuntu~24.04.1 | < 37.2ubuntu0.1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-8555-1","label":"ubuntu.com/security/notices/USN-8555-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-9494","label":"ubuntu.com/security/CVE-2026-9494","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-11386","label":"ubuntu.com/security/CVE-2026-11386","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2026-12391","label":"ubuntu.com/security/CVE-2026-12391","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2026-11386","CVE-2026-12391","CVE-2026-9494"],"downstream":[],"duplicates":[],"related":["CVE-2026-11386","CVE-2026-12391","CVE-2026-9494"]},"timeline":[{"kind":"published","date":"2026-07-16T12:59:08.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-07-16T21:16:21.242Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T17:42:55.478Z","stale":false,"partial":false}}