Oracle issues security alert for CVE-2026-91403 (CVSS 9.1): Java SE and GraalVM JSSE trust in compromised eMudhra intermediate CAs
Oracle published a security alert on October 21, 2026 for CVE-2026-91403, a critical flaw (CVSS 3.1 9.1) in the Java Secure Socket Extension (JSSE) component of Oracle Java SE and Oracle GraalVM. The issue is certificate trust rather than memory corruption: Oracle's guidance refers to reports of compromised intermediate certificate author…