Oracle has released an emergency Java security update to fix CVE-2026-91403, a critical flaw rated 9.1 out of 10 that affects how Java applications decide which HTTPS certificates to trust. The advisory, published on October 21, 2026, is directly linked to the compromised eMudhra intermediate certificates that have already been blocked by Google and Apple, which makes it especially important for Indian businesses and developers.
The fix makes Java stop trusting the affected eMudhra intermediate certificate authority (CA) certificates. Anyone running Java on servers, desktops or inside business software should update as soon as possible.
What is CVE-2026-91403?
The vulnerability sits in the Java Secure Socket Extension (JSSE), the part of Java that handles secure network connections, including HTTPS. Oracle says the flaw can be exploited remotely over a network, without any login and without the user having to click anything.
The root of the problem is certificate trust. Intermediate CA certificates associated with eMudhra were reported to be affected by weak private keys. In theory, an attacker who abuses those keys could create fraudulent certificates for websites they do not own. A Java application that still trusts those certificates could then be tricked into connecting to an impostor server.
In practical terms, an attacker sitting between a Java app and a server could impersonate a trusted service, read sensitive data or alter the information being exchanged. That is why the flaw scores high on confidentiality and integrity, though it does not affect availability.
It is worth stressing what this is not: HTTPS encryption itself has not been broken. The issue is about Java trusting certificates that should no longer be trusted. Oracle's notice also does not say that the flaw has been exploited in the wild.
Affected Java versions
According to Oracle's advisory, these supported releases are affected:
| Java SE 8 | 8u511, 8u511-perf |
| Java SE 11 | 11.0.33 |
| Java SE 17 | 17.0.21 |
| Java SE 21 | 21.0.13 |
| Java SE 25 | 25.0.5 |
| Java SE 27 | 27.0.1 |
| GraalVM for JDK | 17.0.21, 21.0.13 |
| GraalVM Enterprise Edition | 21.3.20 |
| CVSS 3.1 score | 9.1 (Critical) |
| Advisory date | October 21, 2026 (guidance updated October 22) |
Older releases that are out of Oracle's support window were not tested for this alert, but they may also be vulnerable. If you are running such a version, the safest route is to move to a supported release.
Why it matters for India
eMudhra is an Indian certifying authority whose certificates are widely used in India for digital signatures and secure websites. Earlier this week, browser makers moved to block its compromised certificates, and the company has shut down its global digital certificate business after the security lapse.
Java is everywhere in Indian enterprise IT, from banking back-ends and government portals to tax and accounting tools and payment gateways. Many of these systems run long-lived Java servers that are not updated as often as browsers. That makes the Oracle patch an important second layer of protection, because browser updates alone do not protect server-to-server traffic handled by Java.
The update also lands in the same week that CERT-In flagged critical PHP vulnerabilities, so IT teams are dealing with more than one urgent patch at once.
How to protect your systems: step by step
- Find every Java runtime. Run
java -versionto check the default version, but remember that many applications bundle their own Java. Make a list of all servers and apps that use Java. - Download the update only from official sources such as java.com, Oracle's Java SE downloads page or the Oracle security alert page.
- Test before rolling out in production. Check that critical business applications still work with the new runtime.
- Restart services after updating and confirm the new runtime is the one actually in use.
- If you cannot patch immediately, apply Oracle's interim mitigation: replace the local certificate blocklist (
blocked.certs, orblacklisted.certson Java 8) with Oracle's supplied version, keeping any custom entries. - Consider revocation checking for TLS, which Oracle documents as another option, though it needs careful configuration.
What regular users should do
Most home users do not run Java in the browser any more, but some desktop software, government utilities and games still rely on it. If your computer has Java installed, open the Java control panel or download the latest version from the official site. If you no longer need Java, uninstalling it is a simple way to reduce risk.
What happens next
Expect other Java vendors and Linux distributions that ship their own OpenJDK builds to roll out similar certificate distrust changes. Organisations that rely on eMudhra-issued certificates for their own websites or services will also need to replace them with certificates from another trusted authority, if they have not already done so.
For now, the message is simple: update Java, check every server, and do not assume that a browser update covers everything.
Comments (0)