CVE-2026-91403: Oracle Java Emergency Fix for eMudhra CAs

Oracle on Wednesday released an out-of-band Security Alert for Java SE and GraalVM to stop the runtimes from trusting eight compromised eMudhra intermediate CA certificates.

The issue is tracked as CVE-2026-91403 . Oracle rates it critical, with a CVSS score of 9.1. It sits in the JSSE component, Java’s TLS implementation, and an unauthenticated attacker can exploit it over the network. Oracle’s advisory does not describe the root cause. The OpenJDK advisory , published the same day, does: the CVE concerns eight compromised intermediate CA certificates.

Affected releases are Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, Oracle GraalVM for JDK 17.0.21 and 21.0.13, and GraalVM Enterprise Edition 21.3.20. Oracle said earlier that unsupported versions are likely affected as well.

The certificates belong to eMudhra, the Bengaluru-based certificate authority that sells TLS certificates under the emSign brand. eMudhra created the eight Global TLS intermediates during a key generation ceremony in April 2025. A flaw in that process left them with cryptographically weak keys. One intermediate’s private key was simply 4. The other seven were small numbers ranging from 56 to 237.

An intermediate CA signs the certificates that websites present. Anyone holding one of these keys could therefore mint a certificate for any domain, and clients that trust the chain would accept it. Mozilla said the keys let attackers “issue fraudulent HTTPS certificates for websites they do not control”. An attacker who could intercept a connection could then impersonate a site and read or alter its traffic.

Oracle’s notes say the Java flaw can be exploited through APIs in the component, such as a web service that supplies data to them. It also applies to sandboxed Java Web Start applications and applets that load untrusted code.

The compromise came to light on the weekend of October 17. Chrome’s root program received the report at 18:05 UTC on Saturday and landed a CRLSet block on the affected intermediates within two hours. Mozilla blocked them through OneCRL the same evening. Apple followed on October 19 and Microsoft on October 20.

A summary site run by Dennis Jackson credits the original report to a researcher identified as Wayne. BleepingComputer reported that researcher Flüpke published one of the keys on GitHub.

eMudhra said it revoked all eight intermediates on October 19, and that the incident does not affect its root CA private keys or its other intermediates. The company said most of the certificates were never used in production. It found no evidence they had issued certificates to end users. It has also stopped issuing new certificates under its G3 root.

Google is going further. Chrome plans to remove the emSign ECC Root CA – G3 root on October 27. Google told sites with certificates chaining to that root to replace them right away with certificates from another CA.

Java is not the only runtime to ship a fix. Go released versions 1.27.3 and 1.26.10 for the same issue, tracked as CVE-2026-111943. Python certifi, Electron, pip, rustls-webpki and the major Linux ca-certificates packages have also been updated.

Oracle customers should install the patched build listed in the Java SE patch availability document linked from the alert. OpenJDK advises users of standalone runtimes to update as soon as possible. Until then, they can block the certificates manually by replacing the blocked.certs file in the JDK’s lib/security directory. OpenJDK packages shipped by Linux distributions such as Debian, Fedora, RHEL and Ubuntu usually rely on the system’s certificate store. For those, updating ca-certificates is sufficient.

Join the conversation. Ask questions, solutions, and help others.

Be the first to start the discussion!