VulnerabilitiesOct 22, 2026

CVE-2026-91403: Oracle Java Emergency Fix for eMudhra CAs

Oracle Java SE and GraalVM fix critical vulnerability CVE-2026-91403 affecting eMudhra CAs.

Oracle has released an out-of-band security alert for Java SE and GraalVM to address CVE-2026-91403, a critical vulnerability with a CVSS score of 9.1. The issue stems from eight compromised eMudhra intermediate CA certificates with cryptographically weak keys, allowing attackers to issue fraudulent HTTPS certificates for any domain. Major browsers and operating systems have already taken steps to block these certificates.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Oracle?

Get an email when a new story names Oracle, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

What helps against this

How we list vendors

Oracle affected

Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
For exampleQualys VMDR Rapid7 Exposure Command (InsightVM)Tenable Vulnerability Management all options
Automated patch management
Known holes get closed in days, not months.
For exampleQualys Patch Management Microsoft Intune Action1 Patch Management all options
Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
For exampleDataminr Threat Intelligence Dataminr Agentic Threat Intelligence Platform Defused TF all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

cve — CVE-2026-91403
cve — CVE-2026-111943

Entities

Oracle (vendor)eMudhra (vendor)Java SE (product)GraalVM (product)TLS certificates (technology)