Oracle emergency Java update distrusts weak eMudhra CAs (CVE-2026-91403)
Original title: Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability
The CVSS 9.1 JSSE flaw can let an on-path attacker forge trusted hostnames; no attacks are confirmed.
Oracle published an emergency update on October 21, 2026, for CVE-2026-91403, a CVSS 9.1 flaw in how Java SE and GraalVM trust certificates through JSSE. Red Hat says eMudhra intermediate certificates used weak private keys, so an on-path attacker could issue certificates for arbitrary hostnames. The update distrusts those intermediates rather than removing HTTPS. Oracle does not report confirmed exploitation and offers update, blocked.certs, or revocation-check options.
Unconfirmed: Oracle does not report confirmed attacks, and unsupported earlier releases were not tested.
- Listed Java SE builds include 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1.
- GraalVM for JDK 17.0.21 and 21.0.13 and Enterprise Edition 21.3.20 are included.
- Oracle rates exploitation low complexity, with no authentication or user interaction.
- On Java 8 the replacement file must be named blacklisted.certs.
- Earlier unsupported releases may be vulnerable but were not tested.
Impact: Forge trusted certificates and expose or change sensitive data
| Product | Affected |
|---|---|
| Oracle Java SE | 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1; earlier releases may be vulnerable |
| Oracle GraalVM | JDK 17.0.21 and 21.0.13; Enterprise Edition 21.3.20 |
- 1.Install the latest Java update using Oracle’s patch availability document.
- 2.Replace blocked.certs with Oracle’s file; name it blacklisted.certs on Java 8.
- 3.Or enable the TLS revocation checks Oracle lists as an alternative.
- CVEs
- CVE-2026-91403
- Vendors
- Oracle
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91403 | JSSE trust flaw in Oracle Java SE and GraalVM | 9.1 | — |
From the original article
2 min read at cybersecuritynews.com
Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital certificates. Published on October 21, 2026, the alert assigns the flaw a CVSS 3. 1 score of 9.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.