Oracle CVE-2026-91403 zaifligi haqida xavfsizlik ogohlantirishini e'lon qildi — bu Oracle Java SE va GraalVM ga ta'sir qiluvchi muhim zaiflik. Hujumchilar bu zaiflikdan masofadan turib, autentifikatsiyasiz foydalanishlari mumkin.
21-oktabr 2026-yilda chop etilgan maslahat zaiflikka CVSS 3.1 balli 9.1 ni belgilaydi va eMudhra bilan bog'liq ta'sirlangan oraliq sertifikat markazi sertifikatlariga ishonmaslikni tavsiya qiladi.
Zaiflik aynan Java Secure Socket Extension (JSSE) komponentiga ta'sir qiladi. Oracle bir nechta asosiy xususiyatlarni aniqladi: tarmoq hujum vektori, past hujum murakkabligi, talab qilinadigan imtiyozlar yo'q va foydalanuvchi o'zaro ta'siri talab qilinmaydi.
Muvaffaqiyatli foydalanish maxfiylik va yaxlitlikni jiddiy ravishda buzishi mumkin; ammo bu mavjudlikka ta'sir qilmaydi va umumiy xavfsizlik doirasi o'zgarmaydi.
Xotira buzilishi xatolari haqidagi maslahatlardan farqli o'laroq, bu ogohlantirish sertifikat ishonch muammolariga qaratilgan. Tuzatish eMudhra oraliq CA sertifikatlarining ma'lum to'plamiga ishonchni bekor qilishni o'z ichiga oladi.
Oracle'ning hamrohlik operatsion yo'riqnomasi buzilgan oraliq sertifikatlar haqidagi hisobotlarga ishora qiladi va mijozlarga yangilangan Java relizlarini o'rnatish yoki muqobil yumshatish choralarini qo'llashni buyuradi.
Ogohlantirish va maslahat o'rtasidagi farqni ajratish muhim: Oracle autentifikatsiyasiz masofaviy foydalanish imkoniyatini tasdiqlaydi, ammo chop etilgan maslahat ixtiyoriy kod bajarilishini ko'rsatmaydi, foydalanish zanjirini taqdim etmaydi yoki ta'sirlangan ish vaqti muhitidan foydalanadigan barcha ilovalarni buzish mumkinligini da'vo qilmaydi. Ta'sir darajasi ilovalar ta'sirlangan komponentdan qanday foydalanishiga bog'liq.
Oracle ta'kidlaydiki, foydalanish JSSE API'lari orqali, veb-xizmat ushbu API'larga ma'lumot yetkazib beradigan holatlarda sodir bo'lishi mumkin. Zaiflik shuningdek, Java Web Start ilovalari yoki Java appletlarida ishonchsiz kodni qum qutisi (sandbox) muhitida ishlatadigan tizimlarga ham tegishli — bu ilovalar xavfsizlik uchun Java qum qutisiga tayanadi.
Oracle quyidagi qo'llab-quvvatlanadigan versiyalarni ta'sirlangan deb ro'yxatga oladi:
- Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 va 27.0.1.
- Oracle GraalVM for JDK: 17.0.21 va 21.0.13.
- Oracle GraalVM Enterprise Edition: 21.3.20.
Oldingi relizlar ham zaif bo'lishi mumkin. Oracle Premier Support yoki Extended Support doirasidan tashqaridagi versiyalar ushbu ogohlantirish bilan hal qilingan zaifliklar uchun sinovdan o'tkazilmaganini ogohlantiradi va qo'llab-quvvatlanadigan relizlarga yangilashni tavsiya qiladi.
Oracle eng so'nggi Java versiyasiga yangilashni maslahat beradi. Darhol yangilay olmaydigan tashkilotlar uchun 22-oktabrda yangilangan yo'riqnoma ikkita muqobil chorani taklif qiladi: ta'sirlangan sertifikatlarni qo'lda bloklash yoki bekor qilish tekshiruvini yoqish.
Qo'lda bloklash uchun ma'murlar ish vaqti muhitining lib/security/blocked.certs faylini Oracle'ning operatsion tizimga xos almashtirish fayli bilan almashtirishlari kerak, bunda mavjud maxsus yozuvlar saqlanishi lozim. E'tibor bering, Java 8 uchun almashtirish fayli blacklisted.certs deb nomlanishi kerak.
TLS ilovalari uchun Oracle quyidagi xususiyatlarni o'rnatishni tavsiya qiladi:
-Dcom.sun.net.ssl.checkRevocation=true-Dcom.sun.security.enableCRLDP=true
JDK 17 va undan keyingi versiyalarda imzolangan JAR fayllarini tekshirish uchun quyidagi buyruqdan foydalanish tavsiya etiladi: jarsigner -verify -revcheck -strict [SIGNED_JAR]. Bu choralar sertifikat bilan bog'liq ta'sirni bartaraf etadi, tashkilotlar o'z muhitlaridagi ta'sirlangan ilovalar va qo'llab-quvvatlanadigan Java o'rnatishlari bo'yicha yangilangan ish vaqti muhitlarini joylashtirishga tayyorgarlik ko'rishar ekan.
Oracle issued a security alert for CVE-2026-91403, a critical vulnerability affecting Oracle Java SE and GraalVM. Attackers can exploit this vulnerability remotely without authentication.
The advisory, published on October 21, 2026, assigns the flaw a CVSS 3.1 score of 9.1 and advises distrusting impacted intermediate certificate authority certificates associated with eMudhra.
The vulnerability specifically impacts the Java Secure Socket Extension (JSSE) component. Oracle has identified several key characteristics: it has a network attack vector, low attack complexity, no required privileges, and no user interaction.
Successful exploitation can severely compromise confidentiality and integrity; however, it has no impact on availability, and the overall security scope remains unchanged.
Unlike advisories regarding memory corruption bugs, this alert focuses on certificate trust issues. Remediation involves revoking trust in a specific set of eMudhra intermediate CA certificates.
Oracle’s accompanying operational guidance refers to reports of compromised intermediate certificates and instructs customers to either install updated Java releases or implement alternative mitigations.
It is important to distinguish between the alert and the advisory: Oracle confirms the potential for unauthenticated remote exploitation, but the published advisory does not indicate arbitrary code execution, provide an exploit chain, or claim that all applications using the affected runtime can be exploited. The degree of exposure depends on how applications utilize the impacted component.
Oracle states that exploitation may occur through JSSE APIs in situations where a web service supplies data to those APIs. The vulnerability also applies to environments running untrusted code in sandboxed Java Web Start applicationsor Java applets that rely on the Java sandbox for security.
Oracle lists the following supported versions as affected:
- Oracle Java SE: 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5, and 27.0.1.
- Oracle GraalVM for JDK: 17.0.21 and 21.0.13.
- Oracle GraalVM Enterprise Edition: 21.3.20.
Earlier releases may also be vulnerable. Oracle warns that versions outside of Premier Support or Extended Support have not been tested for vulnerabilities addressed by this alert and recommends upgrading to supported releases.
Oracle advises updating to the latest Java version. For organizations unable to update immediately, guidance updated on October 22 offers two alternative measures: manually block the impacted certificates or enable revocation checking.
For manual blocking, administrators should replace the runtime’s lib/security/blocked.certs file with Oracle’s operating system-specific replacement, while preserving any existing custom entries. Note that for Java 8, the replacement file should be named blacklisted.certs.
For TLS applications, Oracle recommends setting the following properties:
-Dcom.sun.net.ssl.checkRevocation=true-Dcom.sun.security.enableCRLDP=true
To validate signed JAR files on JDK 17 and later, it is suggested to use the command: jarsigner -verify -revcheck -strict [SIGNED_JAR]. These measures address the certificate-related exposure while organizations prepare to deploy updated runtimes across affected applications and supported Java installations within their environments.
Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.