/
← Voltar ao feed
high

Oracle issues security alert for CVE-2026-91403 (CVSS 9.1): Java SE and GraalVM JSSE trust in compromised eMudhra intermediate CAs

1 fonte(s) · 1 atualização(ões) · publicado 23/10/2026 03:11 · coletado há 1 dia

Oracle published a security alert on October 21, 2026 for CVE-2026-91403, a critical flaw (CVSS 3.1 9.1) in the Java Secure Socket Extension (JSSE) component of Oracle Java SE and Oracle GraalVM. The issue is certificate trust rather than memory corruption: Oracle's guidance refers to reports of compromised intermediate certificate authority certificates associated with eMudhra and advises distrusting them. The flaw is network-exploitable with low complexity, no privileges and no user interaction, with high impact on confidentiality and integrity and none on availability. The advisory does not claim arbitrary code execution, describe an exploit chain, or say that every application on the affected runtime is exploitable, and the article does not report in-the-wild exploitation. Exposure depends on how applications use the component.

Entenda a falha

A vulnerabilidade

CVE-2026-91403 (CVSS 3.1 9.1) is a certificate trust flaw in the Java Secure Socket Extension (JSSE) component of Oracle Java SE and Oracle GraalVM. Oracle's guidance refers to reports of compromised eMudhra intermediate CA certificates and advises distrusting them. It is exploitable over the network with low complexity, no privileges and no user interaction, with high impact on confidentiality and integrity and none on availability. Affected: Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1; GraalVM for JDK 17.0.21 and 21.0.13; GraalVM Enterprise 21.3.20. Earlier releases may be affected too. Fix: update to the latest Java release.

Como funciona

According to Oracle, exploitation may happen through JSSE APIs when a web service supplies data to them. It also applies to untrusted code in sandboxed Java Web Start applications or applets that depend on the Java sandbox. The problem is not a bug in how data is parsed: the runtime's trust store still accepts the affected eMudhra intermediate CA certificates, so certificates tied to them are treated as trustworthy. The articles do not give more detail on the exact validation steps. Exposure depends on how each application uses JSSE.

Por que é vulnerável

The root cause is misplaced trust, not memory corruption: the Java runtime trusts intermediate CA certificates that have reportedly been compromised. The advisory does not claim code execution or an exploit chain. The fix is to stop trusting those certificates, through updated Java releases that distrust them or, as a stopgap, by adding them to the runtime's blocked certificate list or enabling revocation checking.

Onde está

The flaw is in the JSSE component of Oracle Java SE and GraalVM; the workaround touches the runtime's lib/security/blocked.certs file (blacklisted.certs on Java 8).

Como foi descoberta

The articles do not say who found the problem. Oracle's guidance refers to reports of compromised eMudhra intermediate CA certificates. Oracle published the security alert on October 21, 2026 and updated its guidance on October 22 with interim mitigations. The coverage does not report exploitation in the wild.

Explicação gerada por IA a partir da matéria e dos artigos, em 23/10/2026 05:18.

Detalhes técnicos

  • Vector: network, low complexity, no privileges, no user interaction, scope unchanged. Confidentiality and integrity are impacted; availability is not.
  • Exploitation may occur through JSSE APIs when a web service supplies data to those APIs. It also applies to untrusted code in sandboxed Java Web Start applications or Java applets that rely on the Java sandbox.
  • Affected supported versions: Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1; Oracle GraalVM for JDK 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition 21.3.20.
  • Earlier releases may also be vulnerable. Versions outside Premier or Extended Support have not been tested.

Remediação

  • Update to the latest Java release.
  • If immediate updating is not possible (guidance updated October 22), manually block the impacted eMudhra intermediate CA certificates by replacing the runtime's lib/security/blocked.certs with Oracle's OS-specific replacement file, keeping any custom entries. On Java 8 the file is named blacklisted.certs.
  • Alternatively, enable revocation checking for TLS applications with -Dcom.sun.net.ssl.checkRevocation=true and -Dcom.sun.security.enableCRLDP=true.
  • On JDK 17 and later, validate signed JARs with jarsigner -verify -revcheck -strict [SIGNED_JAR].
  • Upgrade releases that are outside Oracle support.

Linha do tempo

  1. gbhackers.com ↗ · pub. 23/10/2026 03:11 · coletado 23/10 05:00 primeiro registro

    Oracle issues security alert for CVE-2026-91403 (CVSS 9.1): Java SE and GraalVM JSSE trust in compromised eMudhra intermediate CAs

    ler a análise desta fonte

    Oracle published a security alert on October 21, 2026 for CVE-2026-91403, a critical flaw (CVSS 3.1 9.1) in the Java Secure Socket Extension (JSSE) component of Oracle Java SE and Oracle GraalVM. The issue is certificate trust rather than memory corruption: Oracle's guidance refers to reports of compromised intermediate certificate authority certificates associated with eMudhra and advises distrusting them. The flaw is network-exploitable with low complexity, no privileges and no user interaction, with high impact on confidentiality and integrity and none on availability. The advisory does not claim arbitrary code execution, describe an exploit chain, or say that every application on the affected runtime is exploitable, and the article does not report in-the-wild exploitation. Exposure depends on how applications use the component.

    Technical Details

    • Vector: network, low complexity, no privileges, no user interaction, scope unchanged. Confidentiality and integrity are impacted; availability is not.
    • Exploitation may occur through JSSE APIs when a web service supplies data to those APIs. It also applies to untrusted code in sandboxed Java Web Start applications or Java applets that rely on the Java sandbox.
    • Affected supported versions: Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1; Oracle GraalVM for JDK 17.0.21 and 21.0.13; Oracle GraalVM Enterprise Edition 21.3.20.
    • Earlier releases may also be vulnerable. Versions outside Premier or Extended Support have not been tested.

    Remediation

    • Update to the latest Java release.
    • If immediate updating is not possible (guidance updated October 22), manually block the impacted eMudhra intermediate CA certificates by replacing the runtime's lib/security/blocked.certs with Oracle's OS-specific replacement file, keeping any custom entries. On Java 8 the file is named blacklisted.certs.
    • Alternatively, enable revocation checking for TLS applications with -Dcom.sun.net.ssl.checkRevocation=true and -Dcom.sun.security.enableCRLDP=true.
    • On JDK 17 and later, validate signed JARs with jarsigner -verify -revcheck -strict [SIGNED_JAR].
    • Upgrade releases that are outside Oracle support.