Critical Oracle Java Flaw With CVSS 9.1 Allows Unauthenticated Remote Attacks

Oracle issued a security alert for CVE-2026-91403, a critical vulnerability affecting Oracle Java SE and GraalVM. Attackers can exploit this vulnerability remotely without authentication.

The advisory, published on October 21, 2026, assigns the flaw a CVSS 3.1 score of 9.1 and advises distrusting impacted intermediate certificate authority certificates associated with eMudhra.

The vulnerability specifically impacts the Java Secure Socket Extension (JSSE) component. Oracle has identified several key characteristics: it has a network attack vector, low attack complexity, no required privileges, and no user interaction.

Successful exploitation can severely compromise confidentiality and integrity; however, it has no impact on availability, and the overall security scope remains unchanged.

Critical Oracle Java Flaw

Unlike advisories regarding memory corruption bugs, this alert focuses on certificate trust issues. Remediation involves revoking trust in a specific set of eMudhra intermediate CA certificates.

Oracle’s accompanying operational guidance refers to reports of compromised intermediate certificates and instructs customers to either install updated Java releases or implement alternative mitigations.

It is important to distinguish between the alert and the advisory: Oracle confirms the potential for unauthenticated remote exploitation, but the published advisory does not indicate arbitrary code execution, provide an exploit chain, or claim that all applications using the affected runtime can be exploited. The degree of exposure depends on how applications utilize the impacted component.

Oracle states that exploitation may occur through JSSE APIs in situations where a web service supplies data to those APIs. The vulnerability also applies to environments running untrusted code in sandboxed Java Web Start applications or Java applets that rely on the Java sandbox for security.

Oracle lists the following supported versions as affected:

• Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1.
• Oracle GraalVM for JDK: 17.0.21 and 21.0.13.
• Oracle GraalVM Enterprise Edition: 21.3.20.

Earlier releases may also be vulnerable. Oracle warns that versions outside of Premier Support or Extended Support have not been tested for vulnerabilities addressed by this alert and recommends upgrading to supported releases.

Oracle advises updating to the latest Java version. For organizations unable to update immediately, guidance updated on October 22 offers two alternative measures: manually block the impacted certificates or enable revocation checking.

For manual blocking, administrators should replace the runtime’s `lib/security/blocked.certs` file with Oracle’s operating system-specific replacement, while preserving any existing custom entries. Note that for Java 8, the replacement file should be named `blacklisted.certs`.

For TLS applications, Oracle recommends setting the following properties:

• `-Dcom.sun.net.ssl.checkRevocation=true`
• `-Dcom.sun.security.enableCRLDP=true`

To validate signed JAR files on JDK 17 and later, it is suggested to use the command: `jarsigner -verify -revcheck -strict [SIGNED_JAR]`. These measures address the certificate-related exposure while organizations prepare to deploy updated runtimes across affected applications and supported Java installations within their environments.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.