We are the Frontier
World

Oracle Java Update Fixes Critical Security Flaw

The patch removes compromised root certificates to block remote code execution across multiple Java versions.

Updated on Oct. 31, 2026 in Cybersecurity

Isometric editorial illustration of a heavy industrial steel locking mechanism on a server cabinet door, representing cybersecurity system protection.
Oracle has released a critical security update for Java SE and GraalVM to address a severe vulnerability by removing compromised root certificates. AI Illustration. Upload story photo >

Live Poll

Do you feel confident that your software updates effectively protect your personal data?

Oracle has released critical security updates for Java SE and GraalVM to address CVE-2026-114820, a vulnerability with a 9.1 severity score. This mandatory update, which impacts multiple Java versions, removes compromised root certificates from eMudhra and Comodo.

Why it matters

The update mitigates risks from a compromised certificate authority, which could otherwise allow unauthenticated remote code execution. Because Java environments are pervasive, organizations must act quickly to patch systems and restart instances to ensure their certificate chain is valid.

The vulnerability carries a CVSS severity score of 9.1 out of 10. The patch updates JDK 27 specifically to version 27.0.1.0.3 to remove untrusted root certificates.

The players

Oracle

A global enterprise software company known for managing the Java platform and the GraalVM high-performance virtual machine.

The details

The patch functions by removing three eMudhra emSign root certificates and the Comodo AAA root certificate from the Java trust store. This mechanism prevents attackers from leveraging compromised certificate authorities to conduct man-in-the-middle attacks or forge trusted identities. Users must manually restart all active Java instances after applying the update to ensure the system rejects the revoked certificate signatures.

Timeline

  1. Oracle issued the initial security advisory on October 24, 2026.

  2. The scope of the advisory was expanded to additional products on October 30, 2026.

The Tech Race

This update aligns with broader industry efforts to harden software trust chains against compromised certificate authorities. It follows the precedent established by the 2011 DigiNotar certificate authority breach, where compromised trust anchors required global removal from software root stores.

System administrators and software engineers must update Java SE versions 8, 11, 17, 21, 25, and 27 immediately to mitigate the remote execution risk. Because the removal of root certificates takes effect only after a restart, running instances must be cycled to ensure the security change is active.

The takeaway

The priority for developers is to verify if their current Java deployment includes the affected certificate stores. Monitor Oracle's security portal for further patches if additional certificate authorities are deemed compromised.

Further reading

For more on securing enterprise software environments, visit Cybersecurity.

Source note: This article includes information reported by ADTmag.

Live Poll

Do you feel confident that your software updates effectively protect your personal data?