Cyberattacks | Vulnerabilities

Weak eMudhra Keys Force Emergency Java Update From Oracle

Broken certificate keys could let network attackers pose as any website to Java apps, so Oracle has blocked the certificates. Patch now.

By Content Team

Oct 26, 2026

ON THIS PAGE

Oracle has pushed an emergency Java security update to fix CVE-2026-91403, a critical vulnerability scoring 9.1 on CVSS 3.1, published October 21. The flaw sits in JSSE, the Java SE component that handles HTTPS trust decisions, and also affects GraalVM. Oracle rates it easy to exploit, with no login or user interaction needed.

The root cause lies outside Java’s code: certificate authority eMudhra issued intermediate certificates with weak private keys, after a scripting error left them one byte long. An attacker in a man-in-the-middle position could use those keys to forge certificates for any hostname, making malicious sites appear legitimate to Java clients. Browsers already reject the eight revoked certificates; Oracle’s update makes Java distrust them too.

Affected supported releases are Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1, plus GraalVM for JDK 17.0.21 and 21.0.13 and GraalVM Enterprise Edition 21.3.20. Older, unsupported versions weren’t tested and may also be vulnerable. No confirmed attacks have been reported.

Oracle recommends updating immediately. As a stopgap, admins can replace Java’s blocked.certs file with Oracle’s supplied version (blacklisted.certs on Java 8) or turn on TLS revocation checks.

Source: Cybersecurity News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?