Oracle has issued a critical security update for Java, addressing a significant flaw identified as CVE-2026-91403. This vulnerability, with a severity score of 9.1 on the CVSS 3.1 scale, impacts Oracle Java SE and GraalVM by altering how these applications trust digital certificates. The update, released on October 21, 2026, specifically targets intermediate certificate authority certificates associated with eMudhra.
Understanding the Vulnerability
The security issue is rooted in the Java Secure Socket Extension (JSSE) component. According to Oracle’s advisory, the flaw is considered low complexity to exploit, requiring neither user interaction nor authentication. If exploited successfully, it could lead to exposure or alteration of sensitive data without affecting the system’s availability.
The vulnerability involves the certificate chains that Java uses to verify the trustworthiness of remote services. Red Hat has pointed out that eMudhra issued certificates with weak private keys, which attackers could exploit. By intercepting communications between a Java client and server, they could generate fraudulent certificates, misleading clients into trusting malicious sites.
Impact on Java and GraalVM Versions
Java SE versions 8u511 and others, along with GraalVM versions for JDK 17.0.21 and 21.0.13, are among those affected. While earlier versions may also be vulnerable, they have not been tested due to lack of support. The flaw is particularly concerning for APIs accessed through services feeding data to JSSE, as well as certain Java Web Start applications and applets running untrusted code.
Oracle’s advisory does not cite any confirmed real-world exploits but emphasizes the importance of updating affected systems. It advises either installing the latest patches or following specific mitigation steps provided in its guidance.
Recommended Actions for Users
Oracle recommends that organizations apply the latest security updates promptly. If immediate updating is not feasible, users should implement mitigation strategies, such as replacing local certificate files with those supplied by Oracle. Additional measures include enabling TLS revocation checks and using strict JAR verification for Java 17 and later versions.
This emergency update is part of Oracle’s ongoing efforts to enhance security, following recent patches in September and August. Administrators are urged to consult the specific advisory for detailed implementation instructions and to transition unsupported systems to supported versions where possible.
Staying ahead of potential threats is crucial, and Oracle’s emergency update serves as a reminder to maintain robust defenses against emerging vulnerabilities.
