Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability

Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital certificates. Published on October 21, 2026, the alert assigns the flaw a CVSS 3.1 score of 9.1 and covers Oracle Java SE and GraalVM. The update blocks affected intermediate certificate authority certificates linked to eMudhra.

According to Oracle’s security advisory, the issue affects the Java Secure Socket Extension, or JSSE, component. Oracle rates exploitation as low complexity, with no authentication or user interaction required. Successful attacks can expose or change sensitive data, although the risk matrix lists no availability impact.

The problem involves certificate chains that Java uses to decide whether a remote service is trusted. Red Hat explains that eMudhra issued intermediate certificates with weak private keys. An attacker positioned between a Java client and a server could use those weak keys to create certificates for arbitrary hostnames, making a malicious site appear trusted.

This undermines the identity checks behind HTTPS. Encryption alone cannot protect a connection when the client accepts an attacker’s certificate as valid. The fix therefore changes which certificates Java accepts, rather than removing HTTPS support or replacing the entire certificate system. Oracle’s update specifically distrusts the impacted intermediate certificates.

Affected Java and GraalVM Versions

Oracle lists Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1 as affected. GraalVM for JDK 17.0.21 and 21.0.13, alongside GraalVM Enterprise Edition 21.3.20, are also included. Earlier releases may be vulnerable, but unsupported versions were not tested.

Oracle notes that affected APIs can be reached through services supplying data to JSSE. Its advisory also covers certain sandboxed Java Web Start applications and applets that load untrusted code. The announcement does not report confirmed attacks exploiting this vulnerability.

Oracle recommends installing the latest Java update or following its eMudhra mitigation instructions. Teams unable to update immediately can replace the local blocked.certs file with Oracle’s supplied version, preserving existing custom entries. Java 8 requires the replacement file to be named blacklisted.certs.

Alternatively, Oracle advises enabling TLS revocation checks using -Dcom.sun.net.ssl.checkRevocation=true and -Dcom.sun.security.enableCRLDP=true. For signed JAR verification on JDK 17 and later, it provides jarsigner -verify -revcheck -strict [SIGNED_JAR]. These are alternatives, not steps that must all be applied together.

The emergency alert follows Oracle’s wider patching efforts, including its September security update and August security patches. However, administrators should check this specific advisory rather than assume earlier updates cover the certificate issue. Oracle directs customers to its patch availability document for installation details and recommends moving unsupported deployments to supported releases.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability appeared first on Cyber Security News.