Oracle has released an emergency security update to address a critical vulnerability in Java that could allow attackers to intercept encrypted connections and tamper with sensitive data.
Tracked as CVE-2026-91403, the flaw carries a CVSS score of 9.1 out of 10 and affects Oracle Java SE and several GraalVM builds. Oracle published the security alert on October 21, warning that the vulnerability can be exploited remotely without authentication.
The vulnerability is linked to eight eMudhra intermediate certificate authority certificates with dangerously weak private keys. These certificates were included in Java’s trusted certificate store, potentially allowing attackers to create fraudulent certificates for arbitrary domain names. Applications relying on Java’s secure communication components could then accept connections to malicious servers as trusted, exposing confidential information or allowing data to be modified in transit.
According to Oracle’s advisory, the vulnerability affects Java SE versions 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1. It also affects GraalVM for JDK versions 17.0.21 and 21.0.13, along with GraalVM Enterprise Edition 21.3.20. The issue resides in Java Secure Socket Extension (JSSE), which provides support for secure network communications.
The certificate problem follows the discovery of weak eMudhra private keys that prompted browser vendors to distrust affected certificate authorities. Although the incident does not indicate that Oracle’s own infrastructure was breached, Java applications could remain vulnerable if they continued trusting the affected certificates. The weakness is particularly concerning because an attacker does not need existing credentials to attempt exploitation over a network.
Oracle has made patches available through its security alert and recommends that customers install the appropriate updates for their supported Java versions. Administrators should identify all affected Java runtimes, including those bundled with applications and development environments, and ensure that systems are running fixed builds. Organisations that cannot immediately upgrade should review vendor guidance on blocking the affected intermediate certificates and validating TLS certificate chains.
The incident also highlights why certificate trust stores need careful maintenance. Removing or distrusting compromised certificates helps prevent applications from accepting fraudulent identities, but administrators must ensure that mitigation measures cover every runtime and deployment they operate. Java developers should also review the JDK versions used by production applications, build servers and automated dependency-download tools.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Oracle has not reported confirmed exploitation of CVE-2026-91403 in the advisory. However, given the vulnerability’s severity and remote attack potential, organisations using affected Java releases should prioritise patching rather than assume their systems are safe because no attacks have been reported.
