Oracle’s quarterly Critical Patch Update landed on October 20, 2026, and this one deserves more attention than the usual “update when you get around to it” security release. The CPU patched 55 separate vulnerabilities in Java SE alone, part of a much larger update covering over 1,200 CVEs across Oracle’s full product line, and per Oracle’s own October 2026 Critical Patch Update advisory, 49 of those 55 Java flaws can be exploited remotely without any authentication. That is an unusually high proportion, and it is the main reason this update should not sit in a “later” pile.
Less than 24 hours after the CPU shipped, Oracle followed up with something rarer: an out-of-cycle emergency security alert on October 21 for CVE-2026-91403, a flaw scoring 9.1 out of 10 on the CVSS scale. It sits in Java Secure Socket Extension (JSSE), the component that handles HTTPS and other secure connections. The root cause traces back to intermediate certificate authority certificates issued by eMudhra that turned out to use weak private keys, meaning an attacker positioned between a Java application and whatever server it is talking to could potentially forge a trusted certificate, impersonate that server, and read or tamper with traffic in between, without the user or app doing anything wrong. Oracle has not said this is being actively exploited, but a flaw this easy to trigger and this high-impact gets patched first and explained later.
Which versions actually fix this
The October 20 routine CPU brought Java up to 8u511 (8u511-perf for the Enterprise Performance Pack), 11.0.33, 17.0.21, 21.0.13, and 25.0.5. Java 27 moved to 27.0.1. If you check your version with java -version in a terminal and see any of those, you are current as of the 20th, but not necessarily protected against the certificate flaw discovered the next day. For that, Oracle followed up with .0.2 point releases (27.0.1.0.2, 25.0.5.0.2, 21.0.13.0.2, 17.0.21.0.2, and 11.0.33.0.2) that specifically distrust the affected eMudhra intermediate certificates. If you are on Java 8, Oracle folds its guidance for the certificate issue into the same 8u511 release.
One version worth flagging on its own: Java 26.0.2 appears in the CPU’s affected-products table, but its regular public support already ended in September 2026, so there is no confirmed fix version for it. If you are still on Java 26, treat this as a prompt to move to a supported line like 21 or 25 rather than wait for a patch that may not come.
“I don’t run Java apps, so this doesn’t affect me”
This is the misconception that causes the most missed patches. Java doesn’t always announce itself. It ships bundled inside business software, point-of-sale systems, accounting tools, some VPN clients, and plenty of internal company applications that quietly use a JRE under the hood without ever putting “Java” in their name. If you manage machines for a small business, it is worth actually checking, via the Java applet in Windows Control Panel or java -version in a terminal, rather than assuming a clean search of your Start Menu settles the question.
If you can’t update right away
Oracle’s interim guidance for the certificate flaw, for situations where patching every affected machine immediately isn’t realistic, is to update your certificate blocklist and make sure revocation checking is enabled in your Java configuration. That is a mitigation, not a substitute for the real patch. Treat it as a stopgap measured in days, not a long-term plan, and schedule the actual update as soon as you reasonably can.
The OpenJDK caveat
If you are running an open-source JDK distribution instead of Oracle’s, such as Eclipse Temurin, Amazon Corretto, Microsoft’s OpenJDK build, or Red Hat’s, do not assume you are covered on the same timeline. As of this writing, only Temurin 25 had shipped a build matching the October fixes; Temurin’s 8, 11, 17, and 21 lines were still on August-dated releases, and the other vendors had not confirmed updated builds yet. Check your specific distribution’s release page rather than assuming “Java got patched” covers every JDK you happen to be running. This is also where our guide to what’s new in Java 27 and our writeup of July’s Critical Patch Update are worth a look if you are trying to track Oracle’s release cadence more broadly.
FAQ
What is CVE-2026-91403 and why is it rated so high?
It’s a 9.1 CVSS flaw in Java’s JSSE component, caused by weak private keys in eMudhra intermediate certificates. It lets an attacker between a Java app and a server forge a trusted certificate and intercept or tamper with traffic, remotely and without authentication, which is why Oracle issued an emergency fix a day after its regular October patch.
Do I need to update again if I already installed the October 20 patch?
Yes. The October 20 release (8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1) fixes 55 separate Java SE bugs, but the certificate flaw was disclosed the next day. You need the follow-up .0.2 point releases to distrust the affected eMudhra certificates.
How do I check what Java version I’m running?
Run java -version in a terminal, or on Windows with Java 8 installed, open Control Panel, then Java, then the General tab, then About. Keep in mind bundled runtimes inside other applications won’t show up this way.
Does this affect OpenJDK builds like Temurin or Corretto?
Possibly, but not on the same schedule as Oracle’s own JDK. As of this update, only Eclipse Temurin 25 had a build matching the October fixes; other OpenJDK distributions and Temurin’s older lines hadn’t confirmed updated releases yet, so check your vendor’s release page directly.