Oracle Emergency Java Update Fixes Critical JSSE Certificate-Trust Flaw

Oracle released an emergency security update on October 21 to address CVE-2026-91403, a critical certificate-trust vulnerability in the Java Secure Socket Extension (JSSE) component of Oracle Java SE and GraalVM. Rated CVSS 9.1, the flaw involves eMudhra intermediate certificate authority certificates with weak private keys. An attacker positioned between a client and server could impersonate arbitrary hostnames and expose or modify sensitive application data. Exploitation requires no authentication or user interaction; the reported impacts concern confidentiality and integrity, with no direct availability impact. The announcement reported no confirmed exploitation, and an earlier analysis found no public proof of concept or campaign-specific indicators in cited primary sources as of October 22.

Oracle’s update distrusts the affected intermediate certificates. Organizations should prioritize the latest Java updates, inventory application-bundled and embedded runtimes, and migrate unsupported installations to supported releases. Where immediate updating is impractical, Oracle identifies certificate-blocklist replacement or specified revocation checks as alternatives; temporary network restrictions can also reduce exposure. Security teams should investigate anomalous Java activity and unauthorized data access or modification rather than relying on service outages to signal compromise.