Overview

Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications validate digital certificates used to establish trusted HTTPS connections. The vulnerability has a CVSS 3.1 severity score of 9.1 out of 10 and affects Oracle Java SE and GraalVM environments.

The issue involves compromised trust in certain intermediate certificate authority certificates associated with eMudhra. Under specific conditions, an attacker positioned between a Java application and a remote server could exploit weak cryptographic keys to create fraudulent certificates, potentially allowing malicious servers to appear legitimate.

Oracle's security alert, initially published on October 21, 2026, provides updated Java releases that distrust the affected certificates. Organizations running impacted Java environments should prioritize applying the update or implementing Oracle's recommended mitigations.

Key Facts of the Incident

What Happened

According to Oracle's security alert, CVE-2026-91403 affects the Java Secure Socket Extension (JSSE), which supports secure network communications and certificate validation in Java applications.

The vulnerability is associated with intermediate certificate authority certificates connected to eMudhra. As reported by Cyber Security News, these certificates were issued using weak private keys, creating an opportunity for attackers to undermine the trust Java applications place in digital certificates.

HTTPS relies on certificates to help verify the identity of remote servers. When a Java application connects to a website or service, it checks the server's certificate chain to determine whether the connection can be trusted.

If an attacker can exploit weaknesses in the certificate chain, they may be able to make a malicious server appear legitimate to a vulnerable application.

The potential attack scenario involves the following steps:

1. Positioning between a client and server: An attacker establishes a position from which they can intercept or influence network communications between a Java application and a remote service.

2. Exploiting weak certificate keys: The attacker exploits the weaknesses associated with the affected intermediate certificates to create fraudulent certificates for arbitrary hostnames.

3. Impersonating a trusted service: A vulnerable Java application may accept the fraudulent certificate and incorrectly trust the malicious endpoint.

4. Compromising sensitive communications: If the attack succeeds, the attacker could potentially intercept or modify sensitive information exchanged over the connection.

This attack targets the trust mechanism behind HTTPS rather than simply breaking encryption itself. When certificate validation fails to distinguish a legitimate service from an attacker-controlled one, encrypted communication may no longer provide the expected protection.

Oracle's remediation addresses the certificate trust problem by updating Java to distrust the affected intermediate certificates instead of disabling HTTPS or replacing the entire certificate infrastructure.

Affected Java and GraalVM Versions

Oracle has identified the following supported product versions as affected by CVE-2026-91403:

Oracle notes that earlier releases may also be vulnerable, but unsupported versions were not tested as part of the advisory. Organizations using older or unsupported Java deployments should assess their exposure and plan to migrate to supported releases.

The security alert also covers certain sandboxed Java Web Start applications and applets that load untrusted code and rely on the Java sandbox for protection.

Administrators should consult Oracle's official CVE-2026-91403 advisory to confirm affected versions and access the appropriate patch availability documentation.

Immediate Impact and Risks

The vulnerability presents several potential risks for organizations that rely on Java applications for business operations, sensitive communications, or integrations with external services.

- HTTPS Trust Compromise: Fraudulent certificates could allow malicious endpoints to appear trustworthy to vulnerable Java clients.

- Sensitive Data Exposure: Successful exploitation could expose confidential information transmitted between an application and a remote service.

- Unauthorized Data Modification: An attacker capable of intercepting a vulnerable connection could potentially alter information exchanged between the parties.

- Enterprise Application Risk: Organizations running affected Java versions across internal applications, servers, and client systems may have multiple installations requiring remediation.

- Legacy System Exposure: Unsupported Java deployments may remain vulnerable without a straightforward vendor-provided update, increasing the need for mitigation or migration.

Oracle's risk matrix classifies the vulnerability as remotely exploitable without authentication, with low attack complexity and high potential impact on confidentiality and integrity. It lists no availability impact. The available report does not confirm that attackers have exploited CVE-2026-91403 in real-world attacks.

What Organizations Should Do

Security teams and IT administrators should take the following steps to reduce exposure to CVE-2026-91403.

1. Apply Oracle's Security Update

Identify affected Java SE and GraalVM installations and update them to the latest applicable security release. Verify the installed versions across servers, employee endpoints, application containers, and systems running business-critical Java workloads.

Organizations should consult Oracle's security alert and patch availability documentation before deploying updates.

2. Follow the Recommended Certificate Mitigations

If an immediate update is not possible, administrators should follow Oracle's eMudhra certificate mitigation guidance. The recommended actions include reviewing the affected certificates in the Java truststore and removing the specified certificates where applicable.

Before modifying a truststore, create a backup and assess the potential impact on applications that depend on its existing certificate configuration. Apply the recommended changes consistently across affected Java installations and custom truststores.

3. Enable TLS Certificate Revocation Checks

Oracle also recommends enabling certificate revocation checking for applications using TLS where appropriate. This helps applications check whether certificates have been revoked, providing an additional layer of certificate validation.

Administrators should follow Oracle's instructions for the relevant Java version and application environment rather than applying configuration changes without compatibility testing.

4. Identify Unsupported Java Deployments

Organizations should inventory their Java installations and determine whether any affected systems are running unsupported releases. Where patches are unavailable, prioritize migration to supported versions and apply the vendor's recommended mitigations.

Maintaining an accurate software inventory is particularly important for organizations with distributed applications, legacy systems, or third-party software that bundles its own Java runtime.

5. Review Security Monitoring and Application Trust

Security teams should review monitoring around suspicious network connections, unexpected certificate behavior, and unusual communication with external services. Investigate potential interception or certificate-validation issues, particularly where applications handle sensitive business or customer information.

Although monitoring cannot replace patching, it can help organizations identify suspicious activity and improve their ability to respond to potential attacks.

Why This Matters

CVE-2026-91403 highlights how weaknesses in the digital certificate ecosystem can undermine the security of otherwise encrypted communications. Even when an application uses HTTPS, the connection depends on correctly validating the certificates used to establish trust.

For enterprises, Java is frequently embedded in business applications, integration services, and critical infrastructure. A vulnerability in certificate validation can therefore create risks across multiple systems, especially where organizations have not maintained complete visibility into their software versions and truststore configurations.

The incident also reinforces the importance of timely security updates and reliable certificate management. Organizations should not assume that previously installed Java updates address this specific issue. Security teams need to review Oracle's advisory, identify affected deployments, and apply the appropriate remediation.

The priority is to ensure that affected Java applications no longer trust the compromised certificate chain. By applying Oracle's update, implementing recommended mitigations where necessary, and maintaining supported Java environments, organizations can reduce the risk of fraudulent certificates undermining their secure communications.

Disclaimer: ClearPhish maintains a strict policy of not participating in the theft, distribution, or handling of stolen data or files. The platform does not engage in exfiltration, downloading, hosting, or reposting any illegally obtained information. Any responsibility or legal inquiries regarding security incidents should be directed to the parties responsible. ClearPhish is not involved in such activities.