Oracle alerts on unauthenticated Java JSSE flaw CVE-2026-91403
Original title: Oracle Security Alert Advisory – CVE-2026-91403 (eMudhra cert revocation)
The CVSS 9.1 issue affects named Java SE and GraalVM builds and can be reached through JSSE APIs without credentials.
Oracle's October 21 Security Alert covers CVE-2026-91403 in JSSE for Oracle Java SE, GraalVM for JDK, and GraalVM Enterprise Edition. Oracle scores it CVSS 3.1 base 9.1, with network access, low complexity, no privileges or user interaction, and high confidentiality and integrity impact. The flaw can be reached through component APIs, including a web service, and also applies to sandboxed Java Web Start or applet clients that run untrusted code. The alert does not say whether it is being exploited.
Unconfirmed: The page title mentions eMudhra certificate revocation, but the alert text does not explain that link or any exploitation.
- Listed Java SE versions include 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1.
- GraalVM for JDK 17.0.21 and 21.0.13 and Enterprise Edition 21.3.20 are also listed.
- Oracle says the vulnerability is remotely exploitable without authentication.
- Alert patches are provided only for Premier or Extended Support versions.
- No reporter is credited, and the alert is marked Rev 1.
Impact: Unauthenticated remote high confidentiality and integrity impact via JSSE
| Product | Affected |
|---|---|
| Oracle Java SE | 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1 |
| Oracle GraalVM for JDK | 17.0.21, 21.0.13 |
| Oracle GraalVM Enterprise Edition | 21.3.20 |
- 1.Apply the Security Alert patches for supported Java SE and GraalVM versions.
- 2.Upgrade releases outside Premier or Extended Support to a supported version.
- CVEs
- CVE-2026-91403
- Vendors
- Oracle
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91403 | JSSE trust flaw in Oracle Java SE and GraalVM | 9.1 | — |
From the original article
3 min read at oracle.comSecurity vulnerabilities addressed by this Security Alert affect the products listed below. Please click on the links in the Patch Availability Document column below to access the documentation for patch availability information and installation instructions. Oracle Java SE, versions 8u511, 8u511-perf, 11.
By rayhaanj · oracle.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.