Oracle Issues Emergency Java Update for Critical HTTPS Trust Vulnerability

Oracle has issued an emergency security update to address CVE-2026-91403, a critical vulnerability affecting Java's trust in digital certificates. The flaw, which carries a CVSS 3.1 score of 9.1, impacts Oracle Java SE and GraalVM, specifically targeting the Java Secure Socket Extension (JSSE) component.

The vulnerability arises from weak intermediate certificates issued by eMudhra. Attackers could leverage these weak keys to forge certificates for arbitrary hostnames, enabling them to impersonate trusted websites and undermine the security of HTTPS connections. This allows for the potential exposure or alteration of sensitive data, as the integrity checks that underpin secure communication are compromised.

Oracle's emergency update directly addresses this by distrusting the affected eMudhra intermediate certificates within the Java trust store. This action prevents Java applications from accepting certificates chained through these compromised authorities, thereby restoring the integrity of TLS/SSL connections.

Several versions of Java SE and GraalVM are affected, including Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1. GraalVM for JDK 17.0.21 and 21.0.13, along with GraalVM Enterprise Edition 21.3.20, are also included in the advisory. Oracle notes that earlier, unsupported versions may also be vulnerable.

While Oracle has not reported confirmed exploitation of this vulnerability in the wild, the low complexity and lack of authentication or user interaction required for exploitation highlight its potential severity. The company recommends immediate installation of the latest Java update.

For organizations unable to update immediately, Oracle provides mitigation instructions. These include replacing the local blocked.certs file with a version supplied by Oracle or enabling TLS revocation checks via specific Java system properties. For signed JAR verification on JDK 17 and later, a specific jarsigner command is also provided.

This emergency patch follows Oracle's regular quarterly Critical Patch Updates (CPUs), but administrators are cautioned that this specific certificate trust issue may not be covered by previous general updates. Users should consult the dedicated advisory for precise details and installation guidance.

The vulnerability underscores the critical importance of robust certificate authority vetting and the need for rapid patching when trust mechanisms are compromised, especially for widely used platforms like Java that underpin countless applications and services.