Loading vulnerability…
eMudhra Intermediate CA Certificate Trust Vulnerability in Oracle Java JSSE
CVE-2026-91403 is a certificate-trust vulnerability in the Java Secure Socket Extension (JSSE) component of Oracle Java SE and GraalVM. Affected deployments trust eMudhra intermediate CA certificates associated with weak private keys, potentially allowing an attacker positioned between a Java client and server to present certificates for arbitrary hostnames and impersonate trusted services. Affected supported versions are Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1; Oracle GraalVM for JDK 17.0.21 and 21.0.13; and Oracle GraalVM Enterprise Edition 21.3.20. Unsupported earlier releases may also be affected. Exploitation requires neither authentication nor user interaction and can compromise data confidentiality and integrity. The CVSS v3.1 base score is 9.1.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can undermine TLS peer authentication, exposing sensitive communications and permitting unauthorized creation, modification, or deletion of critical data or other data accessible to affected applications. Oracle assigns high confidentiality and integrity impacts, unchanged scope, and no availability impact. Arbitrary code execution is not established.
If you can’t patch tonight, do this now.
If updating immediately is not possible, replace the runtime's certificate blocklist with Oracle's supplied version while preserving existing custom entries. The file is named blocked.certs for applicable newer releases and blacklisted.certs for Java 8. Oracle also documents TLS revocation checking as an alternative using -Dcom.sun.net.ssl.checkRevocation=true and -Dcom.sun.security.enableCRLDP=true. For signed JAR verification on JDK 17 and later, Oracle provides jarsigner -verify -revcheck -strict [SIGNED_JAR]. Select the appropriate alternative for the deployment using Oracle's emergency advisory; these measures are not necessarily cumulative. Restricting network exposure can reduce attack opportunities but does not correct certificate trust.
Patch, then assume compromise.
Apply the emergency security updates identified in Oracle's October 21, 2026 Security Alert and Java SE Patch Availability Document. These updates distrust the affected eMudhra intermediate certificates. Exact fixed-version identifiers are not available in the supplied information. Inventory and update embedded Java runtimes as well as standalone installations, and migrate unsupported deployments to supported releases. For distribution-maintained runtimes, follow the relevant distribution's guidance rather than assuming Oracle's update applies directly.
No valid public exploits. Mallory filtered out 3 candidates as fakes, detection scripts, or README-only repos.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
74 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.