Oracle has issued an emergency Java security update to fix CVE-2026-91403, a critical certificate-trust vulnerability that affects how Java applications validate digital certificates. Published on October 21, 2026, Oracle assigned the flaw a CVSS 3.1 score of 9.1. The advisory covers Oracle Java SE and GraalVM and blocks the affected intermediate certificate authority certificates associated with eMudhra.
Oracle’s advisory states the flaw exists in the Java Secure Socket Extension (JSSE) component. Exploitation is rated low complexity and requires neither authentication nor user interaction. A successful exploit can expose or alter sensitive data; the advisory reports no impact to availability.
The issue arises from certificate chains that Java uses to determine whether a remote service is trusted. According to Red Hat, eMudhra issued intermediate certificates with weak private keys. An attacker positioned between a Java client and a server could use those weak keys to mint certificates for arbitrary hostnames, causing a malicious site to appear trusted to the client.
That scenario defeats the identity verification that HTTPS relies on: encryption alone cannot protect a connection if the client accepts an attacker’s certificate as valid. The update therefore changes which certificates Java will trust rather than disabling HTTPS or replacing the entire certificate system. Specifically, Oracle’s update distrusts the impacted intermediate certificates.
Affected Java and GraalVM versions
Oracle lists the following Java SE releases as affected: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1. Affected GraalVM releases include GraalVM for JDK 17.0.21 and 21.0.13, and GraalVM Enterprise Edition 21.3.20. Earlier, unsupported releases may also be vulnerable but were not tested.
Oracle notes that APIs reachable through services that supply data to JSSE can be affected. The advisory also covers certain sandboxed Java Web Start applications and applets that load untrusted code. Oracle did not report any confirmed attacks exploiting this vulnerability.
Oracle recommends installing the latest Java update or following eMudhra’s mitigation guidance. Teams that cannot update immediately may replace the local blocked.certs file with the version Oracle provides, taking care to preserve any existing custom entries. On Java 8, the replacement file must be named blacklisted.certs.
As alternatives, Oracle advises enabling TLS revocation checks with the system properties -Dcom.sun.net.ssl.checkRevocation=true and -Dcom.sun.security.enableCRLDP=true. For signed JAR verification on JDK 17 and later, Oracle suggests using jarsigner -verify -revcheck -strict [SIGNED_JAR]. These are optional mitigations and do not all need to be applied together.
The emergency advisory follows Oracle’s previous security updates in September and August. Administrators should review this specific advisory rather than assume earlier patches addressed the certificate issue. Oracle points customers to its patch availability documentation for installation details and recommends moving unsupported deployments to supported releases.
Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.
