Oracle Java flaw CVE-2026-91403 allows unauthenticated remote attacks
Original title: Critical Oracle Java Flaw With CVSS 9.1 Allows Unauthenticated Remote Attacks
The CVSS 9.1 JSSE issue concerns trust in compromised eMudhra intermediate certificates, not confirmed code execution.
Oracle’s October 21, 2026 alert covers CVE-2026-91403, a CVSS 9.1 flaw in the Java Secure Socket Extension of Oracle Java SE and GraalVM. An unauthenticated remote attacker can affect confidentiality and integrity, but not availability, through trust in compromised eMudhra intermediate certificates. Oracle lists specific supported builds as affected and says earlier releases may also be vulnerable. Customers should install updated Java releases or block the certificates and enable revocation checking.
Unconfirmed: The advisory confirms exploitation potential but does not say the flaw is being exploited or that every Java application is exposed.
- Listed Java SE builds include 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1.
- GraalVM for JDK 17.0.21 and 21.0.13 and Enterprise Edition 21.3.20 are affected.
- The advisory does not describe arbitrary code execution or an exploit chain.
- Java 8 manual blocking uses blacklisted.certs; later releases use blocked.certs.
- October 22 guidance also covers TLS revocation checking and jarsigner revcheck.
Impact: Remote loss of confidentiality and integrity without authentication
| Product | Affected |
|---|---|
| Oracle Java SE | 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1 |
| Oracle GraalVM for JDK | 17.0.21 and 21.0.13 |
| Oracle GraalVM Enterprise Edition | 21.3.20 |
- 1.Install the latest Java releases for affected supported versions.
- 2.Replace blocked.certs, or blacklisted.certs on Java 8, with Oracle’s file.
- 3.Enable TLS revocation checking with checkRevocation and enableCRLDP.
- CVEs
- CVE-2026-91403
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-91403 | JSSE trust flaw in Oracle Java SE and GraalVM | 9.1 | — |
From the original article
2 min read at gbhackers.com
Oracle issued a security alert for CVE-2026-91403, a critical vulnerability affecting Oracle Java SE and GraalVM. Attackers can exploit this vulnerability remotely without authentication. The advisory, published on October 21, 2026, assigns the flaw a CVSS 3.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.