CVE-2026-91403: CVE-2026-91403: Cryptographic Trust Validation Bypass in Oracle Java SE JSSE via Compromised eMudhra…

#security #cve #cybersecurity

CVE-2026-91403: Cryptographic Trust Validation Bypass in Oracle Java SE JSSE via Compromised eMudhra Intermediate CAs

Vulnerability ID: CVE-2026-91403
CVSS Score: 9.1
Published: 2026-10-21

CVE-2026-91403 is a critical cryptographic trust validation flaw (CWE-327) in the Java Secure Socket Extension (JSSE) component of Oracle Java SE, Oracle GraalVM, and OpenJDK builds. Triggered by the compromise of private signing keys for eight intermediate Certificate Authorities operated by eMudhra (emSign), unpatched Java runtime environments implicitly trust fraudulent TLS and code-signing certificates issued by these compromised intermediates. Because Java disables online certificate revocation checking (OCSP/CRL) by default, an unauthenticated network attacker in an Adversary-in-the-Middle (AiTM) position can intercept, decrypt, and modify encrypted TLS communications or bypass code signature verification without triggering security exceptions.

TL;DR

Unpatched Java runtimes trust 16 compromised eMudhra intermediate CA certificates due to missing blocklist entries and disabled-by-default revocation checking, enabling unauthenticated Adversary-in-the-Middle (AiTM) TLS interception and host impersonation.

⚠️ Exploit Status: POC

Technical Details

Vulnerability ID: CVE-2026-91403 / GHSA-9h75-rf66-wh3r
Affected Component: Java Secure Socket Extension (JSSE) / Trust Store (cacerts & blocked.certs)
Weakness Class: CWE-327: Use of a Broken or Risky Cryptographic Algorithm
CVSS v3.1 Score: 9.1 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
EPSS Score: 0.38% (31.39th Percentile)
Attack Vector: Unauthenticated Network (Adversary-in-the-Middle TLS Interception & Code Signing)
Compromised Indicators: 8 eMudhra Intermediate Private Keys (16 Certificates across emSign & Sectigo AAA)
CISA KEV Status: Not Listed

Affected Systems

Oracle Java SE
Oracle GraalVM for JDK
Oracle GraalVM Enterprise Edition
OpenJDK
Eclipse Temurin
Red Hat OpenJDK
Amazon Corretto
Azul Zulu
Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1 (Fixed in: 8u511+, 11.0.33.0.2+, 17.0.21.0.2+, 21.0.13.0.2+, 25.0.5.0.2+, 27.0.1+)
Oracle GraalVM for JDK: 17.0.21, 21.0.13 (Fixed in: See Oracle Security Alert CVE-2026-91403)
Oracle GraalVM Enterprise Edition: 21.3.20 (Fixed in: See Oracle Security Alert CVE-2026-91403)
OpenJDK / Downstream Distributions: All builds prior to October 2026 intermediate blocklist update (Fixed in: 25.0.5+8, 21.0.13+x, 17.0.21+x)

Exploit Details

OpenJDK: Official Oracle / OpenJDK diagnostic Java utility to inspect the runtime trust store for affected root certificates.
GitHub: Open-source scanner for detecting Java runtime environments vulnerable to CVE-2026-91403.
GitHub: Community verification and analysis repository for CVE-2026-91403.
GitHub: Automated remediation utility for patching Java trust stores against CVE-2026-91403.
GitHub: Remediation script to apply certificate blocklist updates for CVE-2026-91403.
GitHub: CA trust store auditing tool to detect compromised eMudhra intermediate and root certificates.

Mitigation Strategies

Upgrade Oracle Java SE, Oracle GraalVM, and OpenJDK installations to patched builds containing the updated blocked.certs fingerprint database.
Manually append the 16 SHA-256 fingerprints of the compromised eMudhra and Sectigo cross-signed intermediate certificates to $JAVA_HOME/lib/security/blocked.certs (Java 11+) or $JAVA_HOME/jre/lib/security/blacklisted.certs (Java 8).
Remove the affected root CA aliases (emsigneccrootcag3, comodoaaaca, emsignrootcag1, emsignrootcag2) from $JAVA_HOME/lib/security/cacerts using the keytool utility if blocklisting is not supported.
Update operating system ca-certificates packages and regenerate /etc/ssl/certs/java/cacerts on Linux hosts and container images that symlink the JVM keystore to the system trust store.

Remediation Steps:

Inventory all host systems, virtual machines, and container images running Java workloads and verify their trust status using Oracle's CheckCerts.java utility or open-source scanners.
Apply the vendor patch (e.g., Oracle Java SE 11.0.33.0.2+, 17.0.21.0.2+, 21.0.13.0.2+, 25.0.5.0.2+) or update the blocked.certs file with the 16 SHA-256 intermediate hashes.
For Debian/Ubuntu systems using shared system trust stores, run 'apt install --only-upgrade ca-certificates libnss3*' followed by 'update-ca-certificates --fresh'.
Restart all running JVM processes, application servers, and containerized services to ensure the updated trust store and UntrustedCertificates blocklist are loaded into memory.
Verify remediation by re-running CheckCerts.java or testing outbound handshakes against diagnostic endpoints to confirm that chains anchored to the 16 compromised intermediates throw a ValidatorException.

References

Read the full report for CVE-2026-91403 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community