IT Services Circle

Oct 26, 2026 · Information Security

Java CVE-2026-91403: eMudhra CA Private Key Leak Breaks HTTPS Trust — Upgrade & Mitigation Guide

Oracle's Security Alert for CVE-2026-91403 reveals eight eMudhra intermediate CA private keys were leaked, causing Java's trust store to accept forged certificates. Affected versions include Oracle Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1 and GraalVM variants. Remediation requires upgrading to patched builds and restarting JVMs, plus either removing the compromised root certificates from cacerts or enabling revocation checking via JVM flags. Older unsupported JDKs likely share the risk.