---
title: Weak eMudhra Keys Force Emergency Java Update From Oracle
description: Broken certificate keys could let network attackers pose as any website to Java apps, so Oracle has blocked the certificates. Patch now.
canonical_url: https://codekeeper.co/ticker/oracle-emergency-java-update-cve-2026-91403
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks) | [Vulnerabilities](https://codekeeper.co/ticker/tag/vulnerabilities)

# Weak eMudhra Keys Force Emergency Java Update From Oracle

Broken certificate keys could let network attackers pose as any website to Java apps, so Oracle has blocked the certificates. Patch now.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Oct 26, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-emergency-java-update-cve-2026-91403%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-emergency-java-update-cve-2026-91403%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-emergency-java-update-cve-2026-91403%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-emergency-java-update-cve-2026-91403%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-emergency-java-update-cve-2026-91403%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-emergency-java-update-cve-2026-91403%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Oracle has pushed an emergency Java security update to fix CVE-2026-91403, a critical vulnerability scoring 9.1 on CVSS 3.1, published October 21. The flaw sits in JSSE, the Java SE component that handles HTTPS trust decisions, and also affects GraalVM. Oracle rates it easy to exploit, with no login or user interaction needed. The root cause lies outside Java’s code: certificate authority eMudhra issued intermediate certificates with weak private keys, after a scripting error left them one byte long. An attacker in a man-in-the-middle position could use those keys to forge certificates for any hostname, making malicious sites appear legitimate to Java clients. Browsers already reject the eight revoked certificates; Oracle’s update makes Java distrust them too. Affected supported releases are Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1, plus GraalVM for JDK 17.0.21 and 21.0.13 and GraalVM Enterprise Edition 21.3.20. Older, unsupported versions weren’t tested and may also be vulnerable. No confirmed attacks have been reported. Oracle recommends updating immediately. As a stopgap, admins can replace Java’s blocked.certs file with Oracle’s supplied version (blacklisted.certs on Java 8) or turn on TLS revocation checks. Source: [Cybersecurity News](https://cybersecuritynews.com/emergency-java-update/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-emergency-java-update-cve-2026-91403%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-emergency-java-update-cve-2026-91403%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-emergency-java-update-cve-2026-91403%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-emergency-java-update-cve-2026-91403%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-emergency-java-update-cve-2026-91403%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Foracle-emergency-java-update-cve-2026-91403%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Data breaches Florida Health Department Offers Credit Monitoring After Major Data Breach Aug 24, 2026](https://codekeeper.co/ticker/florida-health-department-data-breach-alert)

[More Northern Ireland Schools Hit by Cyber Attack Than First Thought Aug 12, 2026](https://codekeeper.co/ticker/ea-warns-of-c2k-network-cyber-attack)

[Cyberattacks $86 Million Crypto Heist Tied to Tampered Ledger Hardware Oct 14, 2026](https://codekeeper.co/ticker/ledger-device-hack-86m-crypto-stolen)

[UK State Investment Agency Exposed Officials' Data for 40 Hours Aug 11, 2026](https://codekeeper.co/ticker/ukgi-data-breach-exposes-sensitive-info)