21CTO

Oct 22, 2026 · Information Security

Oracle Emergency Java Alert: CVE-2026-91403 Blocks eMudhra Weak Keys

Oracle issued an emergency Java patch for CVE-2026-91403 (CVSS 9.1) after eMudhra CA issued eight intermediate certificates with trivially weak elliptic-curve private keys, enabling anyone to forge HTTPS certificates; Java's independent trust store and disabled revocation checks require immediate JDK upgrades or manual blacklist updates.