Security advisories

Severity: Critical

CVE: CVE-2026-91403

Affected versions: All WSE versions using a non-patched version of Java.

Summary

The private keys of eight eMudhra intermediate CA certificates have been compromised. Java trusts these intermediates through two roots in its trust store (cacerts), so unpatched Java runtimes accept certificates issued from them.

Who is impacted?

Anyone running an unpatched Java release whose trust store contains either of these roots:

• emSign ECC Root CA - G3
• AAA Certificate Services

Fixed in: The table below lists the first patched Java version to resolve this issue. To resolve this vulnerability, configure your WSE instance to use a patched version. If you can't upgrade yet, use the workarounds and mitigations listed below.

Java	First patched version
25	25.0.5
21	21.0.13
17	17.0.21
11	11.0.33
8	8u511

How it works

Java doesn't check Certificate Transparency or certificate revocation by default, so it accepts certificates from the compromised intermediates even though the CA has revoked them.

Workarounds and mitigations

Remove the two roots from the trust store

You can remove emSign ECC Root CA - G3 and AAA Certificate Services from every Java trust store your applications use with keytool -delete, then restart those applications.

Enable revocation checking

Java ignores revocation unless it's enabled. For applications that use TLS, add:

-Dcom.sun.net.ssl.checkRevocation=true -Dcom.sun.security.enableCRLDP=true

Disclosure timeline

• Oct 21, 2026: Oracle published security alert CVE-2026-91403 and patched Java releases became available.
• Oct 23, 2026: Wowza advisory published

References

• eMudhra incident page
• Oracle security alert CVE-2026-91403