✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Critical GitLab Vulnerability Enables Unauthenticated Remote Code Execution

October 26, 2026
Rewterz

Microsoft Patches Critical Authenticator Flaw Enabling Token Theft

October 27, 2026

Oracle Patches Critical Java Vulnerability Linked to eMudhra Compromise

Severity

High

Analysis Summary

Oracle released an emergency security update to address CVE-2026-91403, a critical vulnerability affecting certificate validation in Oracle Java SE and GraalVM. The vulnerability carries a CVSS 3.1 score of 9.1 and could allow attackers to compromise the trust relationships used by Java applications to establish secure connections.

The flaw affects the Java Secure Socket Extension (JSSE), which handles secure communications and certificate validation. According to Oracle, exploitation requires no authentication or user interaction and has low complexity. Successful exploitation could expose or modify sensitive information, although the vulnerability's risk assessment indicates no direct impact on system availability.

The vulnerability is associated with intermediate certificates issued by eMudhra that contain weak private keys. An attacker positioned between a Java client and a server could exploit these weaknesses to create fraudulent certificates for arbitrary hostnames. This could cause Java applications to trust malicious servers, undermining the security of HTTPS connections and potentially enabling man-in-the-middle attacks.

Oracle's emergency update addresses the issue by blocking the affected intermediate certificate authority certificates, preventing Java from trusting certificates associated with the compromised trust chain.

Affected products and versions include Oracle Java SE 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1. Affected GraalVM releases include JDK 17.0.21 and 21.0.13, as well as GraalVM Enterprise Edition 21.3.20. Earlier releases may also be vulnerable, although Oracle has not tested unsupported versions.

Oracle recommends installing the latest security updates or applying its specified eMudhra mitigation measures. Organizations unable to update immediately can replace the local certificate blocklist file with Oracle's updated version while preserving custom entries. Alternatively, administrators can enable TLS certificate revocation checks using the recommended Java system properties.

For signed JAR verification on JDK 17 and later, Oracle recommends using the jarsigner verification command with revocation checking enabled.

Organizations should identify affected Java deployments, prioritize patching, and verify certificate validation configurations. Administrators running unsupported Java versions should migrate to supported releases to ensure continued security coverage.

Impact

  • Security Bypass
  • Data Manipulation
  • Unauthorized Access

Indicators of Compromise

CVE

  • CVE-2026-91403

Remediation

  • Upgrade affected Oracle Java SE and GraalVM installations to the latest security-patched versions recommended by Oracle.
  • Replace the local blocked.certs file with Oracle’s updated version to block affected eMudhra intermediate certificates while preserving custom entries.
  • For Java 8, ensure the replacement certificate blocklist file is named blacklisted.certs as required.
  • Enable TLS certificate revocation checking using -Dcom.sun.net.ssl.checkRevocation=true and -Dcom.sun.security.enableCRLDP=true where applicable.
  • Verify signed JAR files on JDK 17 and later using jarsigner -verify -revcheck -strict [SIGNED_JAR].
  • Identify and update affected Java applications and services that use JSSE for secure communications.
  • Review certificate chains and trust stores to identify reliance on affected eMudhra intermediate certificates.
  • Migrate unsupported Java deployments to supported releases to receive security fixes and ongoing protection.
  • Monitor security logs and network traffic for suspicious certificate validation activity and potential man-in-the-middle attacks.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo