Oracle Security Alert CVE-2026-114820 (CVSS 9.1) pulls eMudhra roots from Java SE and GraalVM

Oracle issued Security Alert CVE-2026-114820 on October 24, 2026 (Rev 1), a critical Java SE and GraalVM issue rated CVSS 3.1 9.1. Oracle lists it under JSSE, but the fix is a trust-store change.

The remedy removes four root CA certificates tied to eMudhra. Oracle's Java updates drop emSign Root CA G1, emSign Root CA G2, emSign ECC Root CA G3 and the Comodo/Sectigo "AAA Certificate Services" root. Oracle says users should update to the latest Java version or apply its recommended mitigations.

Oracle, as CNA, scores it 9.1 under CVSS 3.1. The vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, meaning network-reachable, low complexity, no privileges or user interaction, high confidentiality and integrity impact and no availability impact. NVD has not yet analyzed it (status Received) and currently shows only Oracle's 9.1 score; NIST has not added its own.

These builds are affected. Oracle lists Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 and 27.0.1.0.2, along with Oracle GraalVM for JDK 17.0.21.0.2 and 21.0.13.0.2 and GraalVM Enterprise Edition 21.3.20.0.2. The fixed Java SE builds are the .0.3 releases: 27.0.1.0.3, 25.0.5.0.3, 21.0.13.0.3, 17.0.21.0.3, 11.0.33.0.3 and 8u511-b33. Only the 27.0.1.0.3 release notes name this CVE.

Oracle also lists mitigations for those who cannot update yet. One option is to delete the four roots from the Java keystore with keytool. The other is to enable revocation checking with -Dcom.sun.net.ssl.checkRevocation=true -Dcom.sun.security.enableCRLDP=true. GraalVM Native Image executables need a rebuild, because updating the JDK does not update an existing image.

Exposure covers server-side and sandboxed use. Oracle's risk matrix lists the issue as remotely exploitable without authentication across multiple protocols. It can be reached through the component's APIs, for example through a web service that supplies data to them. It also applies to Java clients that run untrusted code from the internet and rely on the sandbox, typically sandboxed Java Web Start applications or applets. Oracle does not say it is exploited, and it is not in CISA's KEV catalog as of its Oct 23 release.

Oracle says the alert was too critical to wait for the next Critical Patch Update or Critical Security Patch Update. Its regular October CPU shipped on Oct 20. The next monthly CSPU is Nov 17, 2026, and the next quarterly CPU is Jan 19, 2027. A separate Oracle alert, CVE-2026-91403, shipped on Oct 21 in the .0.2 builds and also concerns eMudhra; this is a different CVE.

Sources: Oracle's alert at https://www.oracle.com/security-alerts/alert-cve-2026-114820.html and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-114820.