Oracle Issues Emergency Java Fix for Critical HTTPS Trust Flaw

Oracle has issued an out-of-band security alert for Java, outside its usual quarterly patch cycle. The flaw, tracked as CVE-2026-91403 and rated 9.1 out of 10, sits in the part of Java that handles secure HTTPS connections. This article is for IT administrators, developers and business owners who run Java applications, including banking, ERP, payroll and point-of-sale software that quietly depends on a Java runtime.

Key takeaways

• Oracle published the security alert on October 21, 2026, and it was widely reported on October 23.
• The bug is in the Java Secure Socket Extension (JSSE), which Java programs use to make and check TLS (HTTPS) connections.
• Supported Java SE 8, 11, 17, 21, 25 and 27 lines are listed as affected, along with some GraalVM releases.
• There are no confirmed reports of attacks yet, but exploitation is rated low complexity and needs no login or user action.
• The fix is to install the latest Java update. Oracle also lists temporary workarounds if you cannot update immediately.

What happened

According to Oracle’s alert, as summarised by security news outlets, the problem involves intermediate certificates from the certificate authority eMudhra that were issued with weak private keys. Because Java’s trust store treats certificates chained to these intermediates as valid, an attacker who can abuse those weak keys could create forged certificates that Java accepts as genuine.

In practical terms, a Java application that believes it is talking securely to your bank’s API, a payment gateway, a licence server or an internal web service could instead be talking to an impostor. Oracle rates the impact as exposure or alteration of sensitive data. It does not affect availability, so systems will not crash or slow down. That makes the problem easy to miss.

How an attack would work

The attacker needs to sit between a Java client and the server it connects to. That could happen on a compromised network, a malicious Wi-Fi hotspot, a tampered DNS setup or an infected router. From that position, the attacker presents a forged certificate for the real hostname. A vulnerable Java runtime accepts it, and the attacker can read or change the traffic. No password and no click from a user are required, which is why the score is so high.

Who is affected

The versions reported as affected in Oracle’s alert are:

• Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1
• Oracle GraalVM for JDK: 17.0.21 and 21.0.13
• Oracle GraalVM Enterprise Edition: 21.3.20

Oracle notes that earlier releases may also be affected but were not tested because they are no longer supported. If your organisation is still running an old Java 8 build installed years ago, assume it is at risk.

Why this matters for Nigerian and African businesses

Java is everywhere in enterprise software. Core banking platforms, accounting and HR packages, telecom billing systems and many government portals rely on it, and plenty of small offices run desktop tools that ship with their own bundled Java runtime. These applications often call payment, tax or identity verification services over HTTPS in the background. When a business also relies on shared or public networks, the “attacker in the middle” condition is less far-fetched than it sounds.

How to check whether you run Java

1. On Windows, open Settings > Apps > Installed apps and search for “Java”. Note any version shown.
2. Open Command Prompt or Terminal and run java -version. Compare the result with the list above.
3. Check application folders for bundled runtimes. Many business programs carry their own Java inside a folder named “jre” or “jdk”. Ask the software vendor whether their product uses Java and when they will ship an update.
4. On servers, list running Java processes and ask your developers which runtime each application uses. Containers often pin a specific Java base image.

Oracle’s recommended fixes and workarounds

Best option: update

Install the latest Java update for your release line from Oracle, or the matching update from your Java distribution vendor if you use another build of OpenJDK. Oracle’s advisory and patch availability document list the details for each branch. Move any unsupported deployment to a supported release.

If you cannot update today

• Replace the blocked certificates file. Oracle supplies an updated blocked.certs file (called blacklisted.certs on Java 8). Replace your local copy with Oracle’s version, keeping any custom entries you added.
• Turn on revocation checking. Starting Java with -Dcom.sun.net.ssl.checkRevocation=true and -Dcom.sun.security.enableCRLDP=true makes it check whether certificates have been revoked.
• Verify signed JARs strictly. On JDK 17 and later, use jarsigner -verify -revcheck -strict on signed JAR files.

Oracle presents these as alternatives, so pick the one that suits your environment, then plan the full update.

Common questions

Is anyone exploiting this right now?

Oracle’s announcement did not report any confirmed attacks. That can change quickly once technical details spread, so treat this as urgent but not panic-level.

Do ordinary web browsers have this problem?

The alert concerns Java’s own certificate handling. Browsers keep separate trust stores, so this specific issue is about Java applications, not about browsing the web in Chrome, Edge or Firefox.

Does updating Java break applications?

Updates within the same release line, such as moving from one Java 17 update to a newer one, are designed to be compatible. Test critical business systems first if you can, but don’t let testing stretch into weeks.

What you should do

• Make a list of every machine and application that uses Java, including bundled runtimes.
• Update to the latest Java release for each supported line this week, starting with servers and systems that talk to banks, payment gateways or government services.
• If an update must wait, apply one of Oracle’s workarounds now.
• Ask vendors of Java-based business software for their patch timeline in writing.
• Retire or isolate unsupported Java versions that no longer receive fixes.

Sources

• Oracle Issues Emergency Java Update for Critical 9.1 HTTPS Trust Vulnerability – Cyber Security News
• CVE-2026-91403 – SecurityOnline CVE Watchtower

Featured image: Photo: “Programmer’s Laptop” by Wallboat, CC CC0 1.0, via Openverse — source