Oracle has released an emergency Java security update for a critical flaw in how Java applications decide which certificates to trust. The vulnerability, tracked as CVE-2026-91403 and published on 21 October 2026, carries a CVSS score of 9.1 and affects Oracle Java SE and GraalVM, including the Java Secure Socket Extension (JSSE) component.

How the flaw works

The problem centres on intermediate certificate authority certificates issued by eMudhra with weak private keys. An attacker positioned between a Java client and a server could use those weak keys to create certificates for arbitrary hostnames, making a malicious site appear trusted. Oracle rates exploitation as low complexity, needing no authentication and no user interaction, and says successful attacks can expose or alter sensitive data. Encryption alone cannot protect a connection when the client accepts an attacker's certificate as valid.

The fix

Oracle's update does not remove HTTPS support or replace the certificate system. Instead, it specifically distrusts the affected intermediate certificates, changing which certificates Java accepts. That is the same trust problem behind the wider eMudhra episode that has already forced action in browsers: trust in a certificate chain is only as strong as the weakest key that signed it, and a weak intermediate can undermine the whole chain.

What to do

Organisations running Java applications should apply the emergency update promptly and check which Java versions are in use across servers, desktops and embedded systems. Any Java deployment that has not yet taken the fix should be treated as able to be misled about the identity of the server it is talking to, until it is patched.