Oracle emergency patch for critical Java HTTPS trust flaw CVE-2024-XXXX

Key Takeaways

• Oracle has issued an urgent security patch for a critical Java vulnerability, CVE-2026-91403.
• The flaw impacts how Java applications validate digital certificates, specifically those linked to the eMudhra intermediate certificate authority.
• All supported versions of Oracle Java SE and GraalVM are affected, with a CVSS 3.1 score of 9.1.
• The update blocks compromised intermediate certificates to prevent man-in-the-middle attacks.
• Immediate patching or applying Oracle’s mitigation steps is strongly recommended.

Oracle has released an emergency security update for its Java platform to address a critical vulnerability, identified as CVE-2026-91403. This flaw, which received a CVSS 3.1 score of 9.1, affects the fundamental trust mechanisms within Java applications concerning digital certificates. Published on October 21, 2026, the alert specifically targets issues with intermediate certificate authority certificates associated with eMudhra.

The core of the problem lies within the Java Secure Socket Extension (JSSE) component. According to Oracle’s advisory, the vulnerability is easily exploitable, requiring low complexity and no user authentication or interaction. Successful exploitation could lead to the compromise or alteration of sensitive data, though it does not impact system availability.

This critical flaw undermines the integrity of certificate chains that Java relies upon to establish trust with remote services. As explained by Red Hat, eMudhra issued intermediate certificates with weak private keys. An attacker positioned between a Java client and a server could exploit these weak keys to forge certificates for arbitrary hostnames, effectively tricking Java into trusting a malicious entity.

Such an attack severely compromises the identity verification process underlying HTTPS connections. Even with encryption in place, a connection becomes vulnerable if the client accepts a fraudulent certificate as legitimate. The urgent fix, therefore, does not involve overhauling HTTPS or removing its support, but rather specifically distrusting the identified problematic intermediate certificates within Java’s trust store.

Affected Java and GraalVM Versions

The vulnerability impacts a wide range of Oracle Java SE and GraalVM versions. Specifically, Oracle lists Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1 as affected. GraalVM for JDK 17.0.21 and 21.0.13, along with GraalVM Enterprise Edition 21.3.20, are also included. While earlier, unsupported versions were not explicitly tested, they may also be susceptible to this vulnerability.

Oracle notes that affected APIs can be reached through services that supply data to JSSE. The advisory also extends to certain sandboxed Java Web Start applications and applets that load untrusted code. As of the announcement, Oracle has not reported any confirmed attacks exploiting this vulnerability in the wild.

Oracle strongly advises installing the latest Java update or following its eMudhra mitigation instructions. For organizations unable to apply the update immediately, an alternative involves replacing the local blocked.certs file with Oracle’s provided version, ensuring that any existing custom entries are preserved. For Java 8 deployments, the replacement file must be named blacklisted.certs.

Additional mitigation strategies include enabling TLS revocation checks by setting the system properties -Dcom.sun.net.ssl.checkRevocation=true and -Dcom.sun.security.enableCRLDP=true. For verifying signed JARs on JDK 17 and newer, administrators can use the command jarsigner -verify -revcheck -strict [SIGNED_JAR]. These are distinct alternatives, not cumulative steps.

This emergency alert follows Oracle’s regular patching cycles, including recent security updates in September and August. However, administrators should prioritize reviewing this specific advisory rather than assuming prior updates cover this certificate issue. Oracle directs customers to its patch availability documentation for detailed installation instructions and recommends migrating any unsupported deployments to supported releases.

What You Should Do

• Immediately apply the latest Oracle Java security update to all affected Java SE and GraalVM installations.
• If immediate patching is not feasible, implement the provided mitigation steps, such as replacing the blocked.certs or blacklisted.certs file.
• Consider enabling TLS revocation checks using the specified system properties as an additional layer of defense.
• For JDK 17 and later, utilize the jarsigner -verify -revcheck -strict command for signed JAR verification.
• Migrate any unsupported Java deployments to supported versions to ensure ongoing security updates.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.