Architect's Tech Stack

Oct 26, 2026 · Information Security

Java CVE-2026-91403: Compromised cacerts Roots Allow Silent MITM on All LTS Versions

Oracle disclosed CVE-2026-91403 (CVSS 9.1) where compromised eMudhra intermediate CA private keys in the JDK cacerts trust store allow attackers to forge valid certificates for any domain, enabling undetectable man-in-the-middle attacks on all Java LTS versions; the article details detection via keytool, removal steps, container image fixes, and interim mitigations like revocation checking and custom trust managers.