Oracle Alarms Security Flaw on eMudhra: Flags weak credentials & data theft; Urges Java update for digital immunity

Oracle declared that the flaw could allow attackers to impersonate legitimate websites and steal or alter sensitive information. Rated 9.1 out of 10 for severity of cyber security threat, the vulnerability has prompted Oracle to urge users to update affected Java systems immediately. Weak digital certificates expose security risks Oracle issued the security alert on October 21, Wednesday, addressing a critical vulnerability identified as CVE-2026-91403.

It affects Oracle Java SE and GraalVM, software widely used to run applications and enterprise systems. The problem involves eight intermediate digital certificates issued by eMudhra, a Bengaluru-based certificate authority that provides digital security services under its emSign brand. Digital certificates help computers verify whether a website is genuine.

They are essential to HTTPS connections, which protect information exchanged online. However, the eight certificates were created using cryptographically weak private keys. According to the OpenJDK security advisory, one key was the number four, while the other seven were small numbers ranging from 56 to 237.

An attacker possessing these keys could potentially create fraudulent certificates for websites they do not control. This could allow a malicious website to appear legitimate and enable attackers to intercept, read or modify information exchanged over a connection. The vulnerability affects Java’s component responsible for checking certificates during secure communications.

Neither Oracle nor the cited advisories have reported confirmed attacks exploiting this specific Java vulnerability. Also Read: Violent Protests in Indonesia: Effigy of President Prabowo & police truck burnt; Security deployed as unrest escalates eMudhra revokes certificates as tech giants respond The compromise came to light over the weekend of October 17. Major technology companies quickly moved to block the affected certificates.

Google’s Chrome team introduced restrictions within hours of receiving the report. Mozilla followed, while Apple and Microsoft subsequently took similar action. eMudhra revoked all eight affected intermediate certificates on October 19. The company said that its root certificate authority’s private keys and other intermediate certificates were unaffected.

It also reported finding no evidence that the compromised certificates had been used to issue certificates to end users. Google plans to remove the emSign ECC Root CA – G3 root certificate from Chrome on October 27. Websites relying on this certificate have been advised to replace it with one issued by another trusted authority.

Security fixes have also been released for other software platforms, including Go, Python-related certificate components, Electron and several Linux distributions. The incident demonstrates how weaknesses in a certificate authority’s security processes can affect multiple platforms that rely on digital certificates to establish trust. Oracle urges users to install latest updates & suggests steps for security Oracle has urged customers to install the latest security updates listed in its official advisory.

Affected releases include specified versions of Java 8, 11, 17, 21, 25 and 27, as well as GraalVM. Organisations using older, unsupported Java versions should also take precautions, as Oracle warns that these releases may be vulnerable. Users unable to update immediately can manually block the compromised certificates or enable additional certificate-revocation checks.

However, these are interim measures, not substitutes for installing the recommended update. Businesses should identify Java installations across their servers, enterprise applications, cloud systems and third-party software. Systems exposed to the internet or handling sensitive information should receive priority.

Security teams should also check for unusual network activity, suspicious access to sensitive data and unexpected changes to important files.