Java's second eMudhra alert: this time it's roots, and one of them is load-bearing

Call: Known issue. On Saturday, Oct 24, Oracle issued an out-of-band Security Alert, CVE-2026-114820 (CVSS 9.1). It removes the eMudhra-related root certificates from the JDK keystore. This is the second Java alert for the eMudhra compromise. The first, CVE-2026-91403 on Oct 21, blocked the compromised intermediates. This one goes after the roots. No exploitation has been reported.

What breaks: Oracle’s manual guidance deletes four keystore aliases:

emsignrootcag1
emsignrootcag2
emsigneccrootcag3
comodoaaaca

The last one is AAA Certificate Services, a general-purpose public root that isn’t an eMudhra artifact. Once it’s gone, anything that chains to it stops validating, including TLS connections and signed-JAR checks. If you have a fleet, find out what depends on that root before you remove it.

Who’s hit:

Oracle lists Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, GraalVM for JDK 17/21 and GraalVM EE 21.3.20 as affected. Those are the October CPU builds, so a fully patched JDK is still on the list.
The builds that carry the root removal weren’t named on any page we read. Confirm the build number before you call it done.

Workaround:

Run Oracle’s CheckCerts.java to see whether you’re exposed.
Update to the latest JDK.
If you can’t update, back up cacerts, keytool -delete the four aliases, and restart every JVM. Repeat that for every standalone runtime.
Or leave the roots alone and turn on revocation checking with -Dcom.sun.net.ssl.checkRevocation=true -Dcom.sun.security.enableCRLDP=true. Your JVMs then need to be able to reach the CRL endpoints.

Sources: Oracle Security Alert (opens in a new tab), Oracle eMudhra guidance (opens in a new tab), Severity Daily (opens in a new tab).

Java's second eMudhra alert: this time it's roots, and one of them is load-bearing

Sources

More from October 2026 patch cycle