Java Critical Patch Update October 2026: The Emergency Fix for CVE-2026-91403

Oracle’s October 2026 Critical Patch Update landed on October 20, 2026, with the usual batch of quarterly Java SE fixes. A day later, Oracle published a second, unscheduled alert: CVE-2026-91403, a 9.1-severity flaw in the part of Java that decides whether a website’s security certificate can actually be trusted. If you run Java on your computer or maintain a Java application, that second alert matters more right now than the routine quarterly one.

What CVE-2026-91403 Actually Breaks

The flaw sits in Java Secure Socket Extension (JSSE), the component that handles HTTPS connections for Java applications. A certificate authority called eMudhra issued intermediate CA certificates with weak private keys. Because Java trusted those intermediate certificates, an attacker who obtained one of the weak keys could forge a certificate for essentially any hostname and have Java accept it as legitimate.

That’s a trust problem, not an encryption problem, and the distinction matters. A connection using a forged certificate is still encrypted end to end; it just isn’t talking to who it claims to be. Oracle rates this as low complexity, requiring no authentication and no user interaction, which is exactly the combination that makes a flaw practical to exploit once details are public. As of this writing, no confirmed attacks have been reported, but that’s a head start, not a reason to wait.

Which Java Versions Are Affected

• Java SE 8u511 and 8u511-perf
• Java SE 11.0.33
• Java SE 17.0.21
• Java SE 21.0.13
• Java SE 25.0.5
• Java SE 27.0.1
• GraalVM for JDK 17.0.21 and 21.0.13
• GraalVM Enterprise Edition 21.3.20

Oracle notes that earlier, unsupported releases may share the same weakness but weren’t tested, since Oracle doesn’t patch versions outside its supported list. If you’re on one of those, this is a good forcing function to move to a supported line rather than assume you’re fine by omission.

How to Fix It

1. Update (preferred): install the latest Java release for your version line from java.com/en/download for personal use, or oracle.com/java if you need a specific supported line. Close running Java applications first, since a JVM that’s already running keeps the old, vulnerable code loaded in memory until it’s restarted — installing the patch alone doesn’t fix an already-running process.
2. Can’t update immediately: apply Oracle’s eMudhra mitigation by replacing your local blocked.certs file (blacklisted.certs on Java 8) with the version Oracle supplies, keeping any custom entries you’ve already added.
3. Temporary stopgap: enable TLS revocation checking with the -Dcom.sun.net.ssl.checkRevocation=true and -Dcom.sun.security.enableCRLDP=true JVM flags. For verifying signed JARs on JDK 17 and later, use jarsigner -verify -revcheck -strict. These are stopgaps, not substitutes for actually updating.

Run java -version in Command Prompt (Windows) or Terminal (Mac) before and after to confirm the update actually took effect, rather than assuming the installer finished cleanly.

Don’t Forget the Regular Quarterly Fixes Either

The emergency fix above is separate from Oracle’s scheduled October 20 Critical Patch Update, which fixed 55 Java SE vulnerabilities on its own (OpenJDK’s matching advisory lists 53 for its builds). Of those, 49 are rated remotely exploitable without authentication, though none reach “critical” severity — the highest CVSS score in this batch is 7.5, with 3 rated high, 38 medium, and 14 low. The affected version lines are Oracle Java SE 8u503/8u503-perf, 11.0.32.1, 17.0.20.1, 21.0.12.1, 25.0.4.1, 26.0.2, and 27, plus matching OpenJDK, GraalVM, and JavaFX builds.

If you develop or run server-side Java, the 2D graphics library fix (CVE-2026-91415, CVSS 7.0) is worth prioritizing specifically, since it’s reachable through any API that renders images, fonts, or text from user-supplied input. Installing one of these two updates doesn’t automatically give you the other — make sure whatever installer you grab was built after October 21, 2026, to be sure you have both.

What Not to Do

Don’t assume a padlock icon or “secure connection” label means you’re unaffected; this flaw is specifically about whether the certificate behind that padlock can be trusted, not about the strength of the encryption itself. Don’t dismiss this as a server-side problem either — the vulnerable code runs in the Java client validating the certificate, so desktop apps and any Java program making outbound HTTPS calls are exposed, not just backend servers. And don’t treat the mitigation-file workaround as a permanent fix if you’re able to update instead; Oracle describes it as a stopgap for people who can’t patch right away.

Common Misconceptions

This is not a remote code execution bug. Oracle’s advisory lists no code-execution or availability impact, only exposure through forged trust, meaning data could be viewed or altered in transit. It’s also not limited to one platform: Windows, macOS, and Linux installations of Java are equally exposed, since the flaw lives in Java’s own certificate validation logic rather than anything operating-system specific.

Related: Java Critical Patch Update August 2026: New Versions and Why Oracle Now Patches Twice as Often · Java Critical Patch Update July 2026: New Versions and How to Update Safely

FAQ