Oracle has issued an emergency security alert to address a critical vulnerability (CVE-2026-91403) in the Java ecosystem. With a severity score (CVSS) of 9.1, this vulnerability could allow remote exploitation without authentication.
What Happened?#
The root of the issue lies in the JSSE (Java Secure Socket Extension) component. The vulnerability stems from the system’s failure to block an untrusted (distrusted) intermediate eMudhra Certificate Authority (CA).
JSSE is responsible for securing data communications over networks (such as HTTPS/TLS). Because vulnerable Java systems still consider the problematic certificate valid, an attacker could intercept, manipulate, or spoof network connections that should be secure. This could seriously affect data confidentiality and integrity.
Who Is Affected?#
This vulnerability affects a wide range of Java versions, including those running on servers and in client-side applications (such as sandboxed Java Web Start). Affected products include:
- Oracle GraalVM Enterprise Edition, Version
21.3.20 - Oracle GraalVM for JDK, Versions
17.0.21,21.0.13 - Oracle Java SE, Versions 8u511,
11.0.33,17.0.21,21.0.13,25.0.5,27.0.1
Mitigation#
The recommended course of action is to update Java immediately to the latest patch provided by Oracle. This update will automatically refresh the Java certificate database (truststore) and revoke trust in (distrust) the problematic eMudhra certificate set, helping secure network communications again.
Have You Updated Java Today?#
Check your current Java version with the following command:
java -version
