Java CVE-2026-91403: eMudhra CA Private Key Leak Breaks HTTPS Trust — Upgrade & Mitigation Guide

Official Oracle Security Alert

Oracle issued a Security Alert (not a routine update) for CVE-2026-91403 . The core issue: Java updates make affected eMudhra-related intermediate CA certificates no longer trusted . The vulnerability resides in the JSSE component, is remotely exploitable without authentication , and carries a CVSS 9.1 score.

CVE-2026-91403 : Provides Java updates so that affected eMudhra-related intermediate CA certificates are no longer trusted. Workaround: upgrade to latest Java or follow official mitigation. Component: JSSE; remotely exploitable, no authentication required; CVSS 9.1.

Vulnerability Essence: Private Key Leakage → Trust Broken

In one sentence: Intermediate CA private keys leaked; if the JDK trust store still trusts them, forged certificates may be accepted as valid.

Normal HTTPS/signature verification: Java checks whether a certificate is signed by a trusted CA.

Incident: 8 eMudhra intermediate CA private keys have been leaked (per official wording).

Risk: Attackers can forge certificates that appear legitimate; Java programs trusting that chain may accept the wrong identity.

This is not a remote code execution flaw in the Java runtime itself. It is a trust compromise : fake identities that should be blocked are not.

Affected Versions

Explicitly Listed (Patches Available)

Oracle Java SE : 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1

GraalVM for JDK : 17.0.21, 21.0.13

GraalVM EE : 21.3.20

Older Unlisted Versions

Not listed ≠ no risk. Oracle states patches are only guaranteed for supported releases; earlier versions were not individually tested but very likely affected . Common older builds such as 8u202, 8u391 should be treated as potentially vulnerable — do not rely on luck.

Four-Step Action Plan (In Order)

1) Check Version

java -version

Run on every server, container, and CI/CD pipeline JDK. Each JDK installation must be inventoried.

2) Upgrade & Restart JVM (Preferred)

Oracle provides fixed builds, for example:

8u511 b32

11.0.33.0.2

/ 17.0.21.0.2 /

21.0.13.0.2

25.0.5.0.2

/ 27.0.1.0.2 Install per the Patch Availability document. No restart = fix not applied.

3) Temporary Hardening (If Upgrade Not Possible, or Required Even After Upgrade)

Even after upgrading to the versions above, Oracle requires one of the following before restart :

Option A: Remove the compromised root certificates from cacerts (backup first)

JDK 11+: $JDK_HOME/lib/security/cacerts JDK 8:

$JDK_HOME/jre/lib/security/cacerts

# JDK 11+
keytool -delete -cacerts -alias "emsigneccrootcag3 [jdk]"
keytool -delete -cacerts -alias "comodoaaaca [jdk]"

Option B: Enable revocation checking

-Dcom.sun.net.ssl.checkRevocation=true
-Dcom.sun.security.enableCRLDP=true

4) Self-Check & Staging Verification

Run Oracle's CheckCerts.java (JDK 8+).

Staging focus: outbound HTTPS, mutual TLS, signature verification.

Watch logs for SSLHandshakeException, PKIX errors.

Back up old JDK and cacerts beforehand for rollback.

Key Takeaways

What did Oracle say? eMudhra intermediate certificates must no longer be trusted; upgrade or apply official mitigation.

Root cause? Private key leakage → forged certificates may be accepted by JDK.

Am I affected? Listed versions have patches; older JDKs very likely share the risk .

What to do today? Check version → Upgrade & restart → Temporary hardening → Staging verification