Oracle Issues Java Security Alert to Distrust Compromised eMudhra Certificates

TL;DR

Oracle has issued an out-of-band Oracle Java security alert for CVE-2026-91403, rated CVSS 9.1. The update distrusts intermediate CA certificates tied to the eMudhra compromise in Java SE and GraalVM. Admins should update Java now or block the certificates by hand.

Why It Matters

Java checks TLS certificates and signed code against its built-in trust store. If that store still trusts the leaked eMudhra intermediates, an attacker could present a forged certificate that Java accepts. Oracle says successful attacks can bring “complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.”

Oracle is not alone. Between October 17 and 19, Mozilla, Google and Apple moved to block the same certificates, and Node.js also updated its trust store. As a result, Java now joins a wide industry response. Applications that bundle their own Java runtime will need updates too.

How the Attack Works

The flaw sits in JSSE, Java’s TLS component. According to the Oracle Security Alert for CVE-2026-91403, it is an “easily exploitable vulnerability” that an “unauthenticated attacker with network access via multiple protocols” can abuse.

In practice, the risk comes from trust, not from a code bug. A certificate signed by a compromised intermediate could let an attacker impersonate a server or sign malicious code. Oracle adds that the issue also affects sandboxed Java Web Start apps and applets that “load and run untrusted code.”

Exploitation status

Oracle does not report active exploitation of CVE-2026-91403, and the flaw is not in CISA’s KEV catalog. Still, the certificates themselves were compromised, which is why this Oracle Java security alert arrived outside the normal quarterly patch cycle.

Affected Versions

• Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1
• Oracle GraalVM for JDK 17.0.21 and 21.0.13
• Oracle GraalVM Enterprise Edition 21.3.20

Patch and Mitigation Steps

The fix comes through the latest Java release, available from Java Downloads and My Oracle Support. If you cannot update, Oracle’s guidance on distrusting eMudhra intermediate certificates in Oracle JDK lists two options:

• Replace the local blocked.certs file with Oracle’s updated version. On Java 8, the file is named blacklisted.certs.
• Turn on revocation checking for TLS applications.
• On JDK 17 and later, verify signed JARs with revocation checks enabled.

Back up any custom entries before you replace blocked.certs. Given the CVSS 9.1 rating, treat this Oracle Java security alert as a priority and update every Java runtime you manage.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.