Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability

What happened?

Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital certificates. Published on October 21, 2026, the alert assigns the flaw a CVSS 3.1 score of 9.1 and covers Oracle Java SE and GraalVM. The update blocks affected intermediate certificate authority certificates linked to eMudhra. According to Oracle’s security advisory, the issue affects the Java Secure Socket Extension, or JSSE, component. Oracle rates exploitation as low complexity, with no authentication or user interaction required.

Key details

• Oracle released an emergency Java update for CVE-2026-91403, a critical HTTPS trust vulnerability with CVSS 9.1.
• The flaw resides in the Java Secure Socket Extension component and allows low-complexity exploitation without authentication or user interaction.
• eMudhra issued intermediate certificates with weak private keys, enabling attackers to forge certificates for arbitrary hostnames.
• Affected versions include multiple Java SE releases (8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1) and GraalVM variants.
• The advisory also covers sandboxed Java Web Start applications and applets that load untrusted code.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.