Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability

Home Cyber Security Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability By Guru Baran October 23, 2026 Oracle has released an emergency Java security update to address CVE-2026-91403, a critical vulnerability affecting how Java applications trust digital certificates.

Published on October 21, 2026, the alert assigns the flaw a CVSS 3.1 score of 9.1 and covers Oracle Java SE and GraalVM. The update blocks affected intermediate certificate authority certificates linked to eMudhra. According to Oracle’s security advisory, the issue affects the Java Secure Socket Extension, or JSSE, component.

Oracle rates exploitation as low complexity, with no authentication or user interaction required. Successful attacks can expose or change sensitive data, although the risk matrix lists no availability impact. The problem involves certificate chains that Java uses to decide whether a remote service is trusted.

Red Hat explains that eMudhra issued intermediate certificates with weak private keys. An attacker positioned between a Java client and a server could use those weak keys to create certificates for arbitrary hostnames, making a malicious site appear trusted.…

Abbreviated excerpt as provided by the publisher; the full article is at the canonical source. Attributed to Cyber Security News · Limited verification; verify facts against the linked source. Read the full article on cybersecuritynews.com.

Source published: 23 Oct 2026, 11:31 AM IST. Source facts take precedence over AI interpretation.