CVE-2026-91403: Java JSSE trusts compromised eMudhra intermediate CAs

A critical flaw CVE-2026-91403 (CVSS 9.1) in Java SE, GraalVM and OpenJDK JSSE lets unpatched runtimes trust fraudulent TLS and code-signing certificates after eight eMudhra intermediate CA keys were compromised. Java disables OCSP/CRL revocation checks by default, enabling unauthenticated adversary-in-the-middle interception. Fixes ship in 8u511+, 11.0.33.0.2+, 17.0.21.0.2+, 21.0.13.0.2+, 25.0.5.0.2+ and 27.0.1+.

• CVSS 9.1, CWE-327, published October 21, 2026
• Eight eMudhra intermediate keys compromised, 16 certificates affected
• OCSP/CRL checks are off by default in Java, easing AiTM attacks
• Patched in 8u511+, 11.0.33.0.2+, 17.0.21.0.2+, 21.0.13.0.2+, 25.0.5.0.2+