ORACLE has issued an out-of-band security alert for CVE-2026-91403 relating to compromised eMudhra intermediate certificates that affect Java’s trust store in Oracle Java SE and GraalVM. The advisory, rated CVSS 9.1 (Critical, CVSSv3), warns that if Java continues to trust the leaked eMudhra intermediates, an attacker could present forged certificates that Java would accept, potentially enabling impersonation of servers or signing of malicious code.
Oracle notes that successful attacks could give access to data across Oracle Java SE and GraalVM platforms. The alert arrived outside the normal quarterly patch cycle, as the compromised certificates themselves posed a risk even without confirmed exploitation.
Affected products and versions include Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 (and +2 more), along with Oracle GraalVM for JDK 17.0.21 and 21.0.13, and GraalVM Enterprise Edition 21.3.20. The recommended response is to update to the latest Java release or manually distrust the eMudhra intermediate certificates.
Oracle provides guidance to replace the local blocked[.]certs (on Java 8, named blacklisted[.]certs) or enable revocation checking for TLS applications; for JDK 17 and later, enable revocation checks when verifying signed JARs. Organisations should back up any custom entries before replacing blocked[.]certs, given the high severity of this issue and the need to update every Java runtime in use. The report notes that several major vendors have also blocked the compromised certificates, underscoring a broad industry response.