Oracle’s October 21, 2026, Security Alert identifies CVE-2026-91403 in JSSE and assigns it a CVSS 3.1 score of 9.1. Java administrators can match their product and version to the right vendor notice, then follow Oracle’s certificate-mitigation instructions using the syntax for Java 8 or JDK 11 and later.

What CVE-2026-91403 affects

Oracle’s alert describes a remotely exploitable issue that requires no privileges or user interaction and has low attack complexity. Its risk matrix lists high impacts on confidentiality and integrity, with no impact on availability. Oracle says its Java updates distrust affected intermediate CA certificates related to eMudhra. (Oracle’s Security Alert)

The 9.1 score describes severity and attack conditions. It is useful for prioritizing remediation alongside the product and version checks below.

Match the version to the vendor notice

CVE-2026-91403: Check affected Java versions and mitigate

Oracle’s affected-product list names these versions:

  • Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1.
  • Oracle GraalVM for JDK: 17.0.21 and 21.0.13.
  • Oracle GraalVM Enterprise Edition: 21.3.20.

Oracle says Security Alert patches are provided for versions under Premier Support or Extended Support. It also says earlier releases may be affected; releases outside those support phases are not tested for this issue.

OpenJDK published a separate advisory for CVE-2026-91403 under security-libs/javax.net.ssl and recommends upgrading. Its affected-version statement names 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.32.1, 8u504 and earlier. (OpenJDK advisory)

Use the version statement that matches the Java distribution you run. The OpenJDK advisory does not identify the precise patched package for every downstream distributor.

Prepare Oracle’s truststore mitigation

Oracle’s Java mitigation page describes two options: remove two named root certificates from the truststore, or enable revocation checking for TLS applications. Back up the truststore before making either change. (Oracle Java mitigation instructions)

  1. Back up the truststore. Oracle puts this before any certificate removal.
  2. Choose one of the documented paths. You can remove the named certificates or enable TLS revocation checking.
  3. If removing certificates, use the syntax for your Java version. The aliases are emsigneccrootcag3 [jdk] for emSign ECC Root CA - G3 and comodoaaaca [jdk] for AAA Certificate Services.For JDK 11 and later, run the corresponding command for each alias:keytool -delete -cacerts -alias "emsigneccrootcag3 [jdk]" keytool -delete -cacerts -alias "comodoaaaca [jdk]" For Java 8, use -keystore [JDK_HOME]/jre/lib/security/cacerts in place of -cacerts:keytool -delete -keystore [JDK_HOME]/jre/lib/security/cacerts -alias "emsigneccrootcag3 [jdk]" keytool -delete -keystore [JDK_HOME]/jre/lib/security/cacerts -alias "comodoaaaca [jdk]"
  4. If using revocation checking instead, enable the listed TLS properties:-Dcom.sun.net.ssl.checkRevocation=true -Dcom.sun.security.enableCRLDP=true
  5. Apply the chosen change to each affected Java installation and custom application truststore. Oracle’s instructions call out both, so updating the default truststore alone may leave a custom one unchanged.

For signed-JAR validation with JDK 17 and later, Oracle also lists this command:

jarsigner -verify -revcheck -strict [SIGNED_JAR]