I’M UNDER A CYBER ATTACK

Alert

Alert 2026-121 Critical Vulnerability in Oracle Java SE and GraalVM

Affected product(s): 

ProductAffected versions
Oracle Java SE8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1
Oracle GraalVM for JDK17.0.21, 21.0.13
Oracle GraalVM Enterprise Edition21.3.20

Oracle indicates that older unsupported versions are also likely affected.

Description

A critical vulnerability has been disclosed in the JSSE (Java Secure Socket Extension) component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, identified as CVE-2026-91403 (CVSSv3.1 9.1 – CRITICAL). An unauthenticated attacker with network access, via multiple protocols, can easily exploit it to create, modify, or delete critical data without authorization, and to access all data to which these platforms have access.

The flaw is due to the JDK continuing to trust a set of compromised eMudhra intermediate CA certificates (8 eMudhra intermediate certificates and 8 certificates cross-signed by Sectigo). The JDK accepted them as valid in TLS connections and when verifying signed JARs.

According to Oracle, the vulnerability can be exploited through the component’s APIs, for example, through a web service that supplies them with data. It also affects deployments that run untrusted code within the Java sandbox (Java Web Start applications or applets). As of the date of this advisory, the CVE is not listed in CISA’s KEV catalog.

Mitigation

If an immediate update is not possible, Oracle recommends applying one of the following measures:

  • Manually block the affected certificates: download the blocked.certs file published by Oracle for the corresponding operating system and replace [JDK_HOME]/lib/security/blocked.certs (first, back up the file and re-add your own entries). In Java 8, rename the file to blacklisted.certs in the same location.
  • Enable revocation checking: in TLS applications, add the parameters -Dcom.sun.net.ssl.checkRevocation=true -Dcom.sun.security.enableCRLDP=true on the command line. To validate signed JARs in JDK 17 and later, use jarsigner -verify -revcheck -strict [SIGNED_JAR].

https://ops.java/emudhra

Solution

Oracle published an out-of-cycle Security Alert with Java updates on 21/10/2026. It is recommended to inventory Java SE and GraalVM installations, prioritize services exposed to the Internet, and update to the following versions:

Oracle Java SE branchFixed version
88u511 b32 (1.8.0_511-b32)
1111.0.33.0.2
1717.0.21.0.2
2121.0.13.0.2
2525.0.5.0.2
2727.0.1.0.2

For Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition, apply the patches specified in the Java SE Patch Availability Document (My Oracle Support), linked from the Security Alert.

Oracle Java SE downloads:

https://www.oracle.com/java/technologies/downloads/

Oracle Security Alert:

https://www.oracle.com/security-alerts/alert-cve-2026-91403.html

Additional information: