This article was published on October 26, 2026.
Preface: The reason this design flaw spans across three different products comes down to shared foundation code. As explained, GraalVM products are not built entirely from scratch; they use the standard Oracle Java SE libraries as their base core. If a critical component in that base layer has a structural mistake, every derivative product inherits it immediately.
Background: Oracle has issued consecutive critical out-of-band security alerts regarding a severe architectural trust vulnerability (CVE-2026-91403 and CVE-2026-114820) impacting multiple Java deployment runtimes.
Due to a shared foundation code design, a compromised collection of eMudhra intermediate and Sectigo AAA root Certificate Authority (CA) certificates remain hardcoded inside the default Java keystore (cacerts).
Because Java applications do not automatically consume browser-based certificate revocation streams, unpatched runtimes will blindly validate forged TLS certificates signed by these compromised keys. An unauthenticated attacker using network layer manipulation (such as DNS spoofing or routing hijacks) can execute a Man-in-the-Middle (MitM) attack, intercepting and decrypting sensitive application payloads in plaintext.
Please refer to the attached infographic for a complete visual breakdown of how this flaw bypasses the TrustManager during the JSSE security handshake.
Highest Risk Vectors
• Java Outbound Clients: Microservices, webhooks, or payment gateways initiating outbound connections to external APIs via HTTPS.
• Internal-only services are considered lower risk but remain vulnerable if an attacker achieves an initial foothold on the internal network layer.
Affected Products
All standard, unpatched distributions across the following major version baselines are vulnerable:
• Oracle Java SE (Versions 8, 11, 17, 21, 25, 27)
• Oracle GraalVM for JDK / GraalVM Enterprise Edition
• Upstream OpenJDK distributions sharing the standard root trust template
Official announcement: Please refer to the link for details –