Oracle has released an emergency security update to fix a severe vulnerability in Java that earns a CVSS 3.1 severity score of 9.1. The flaw—tracked as CVE-2026-91403—affects both Oracle Java SE and GraalVM, and allows attackers to exploit weaknesses in how Java trusts certain HTTPS certificates. The update, published on October 21, 2026, addresses compromised intermediate certificate authority (CA) certificates issued by eMudhra.
What’s Vulnerable and the Threat
The bug lies in Java’s Secure Socket Extension (JSSE) component. Oracle warns that exploiting it requires no user interaction or authentication, and the difficulty for attack is low. Although it doesn’t impact system availability, it could let an attacker intercept or alter sensitive communications.
The core issue stems from intermediate CAs issued by eMudhra having weak private keys. In practical terms, someone could perform a man-in-the-middle attack, using fake certificates that appear valid for arbitrary hostnames and break HTTPS identity checks. This means even encrypted connections could be deceived if the client trusts a certificate chain stemming from one of the affected intermediate CAs.
Affected Versions and Scope
Oracle has flagged multiple major Java SE releases as impacted: 8u511 (including performance editions), 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1. Some versions of GraalVM—tied to JDK versions 17.0.21 and 21.0.13 including the Enterprise Edition 21.3.20—are also vulnerable. Older or unsupported versions may be exposed, but haven’t been officially assessed.
Besides standard JSSE-based applications, Oracle includes sandboxed Java Web Start applets and applications using untrusted code loading. While no confirmed attacks have been reported yet, the risks are considered serious given how trust models could be undermined.
Workarounds and Mitigation Strategies
Oracle’s recommended action is installing the latest patch right away. For those who cannot apply updates immediately, there are several temporary mitigations:
- Replace a local
blocked.certsfile with Oracle’s updated version—Java 8 requires the file be namedblacklisted.certs. - Enable TLS revocation checks via system properties:
-Dcom.sun.net.ssl.checkRevocation=trueand-Dcom.sun.security.enableCRLDP=true. - On JDK 17 and newer, use
jarsigner -verify -revcheck -strict [SIGNED_JAR]for verifying signed JARs.
These steps are alternative pathways rather than combined prerequisites. The patch makes JSSE distrust the affected certificates outright—there’s no removal of HTTPS support, just a change in which CAs Java accepts.
Why This Fix Matters Now
This emergency patch builds on Oracle’s recent security work, including major updates in September and August 2026. Still, those earlier releases did not address this specific certificate trust issue, making this advisory especially critical for system administrators and developers. Supported version upgrades are urged for any Java environments still running older or unsupported releases.
This kind of flaw hits at the trust foundation of HTTPS. Even the strongest encryption won’t help if certificate validation is compromised—spawning potential scenarios where a malicious server could masquerade as a trusted domain and intercept sensitive data. It’s not just about keeping systems up to date; it’s about preserving the integrity of how users and services trust each other online.
