Payments are experiencing issues due to temporary restrictions in Russia. If your payment does not go through, please submit a support request.Our support team is available 24/7 — we are always here to help with hosting and server issues.We are now accepting requests for dedicated server rental and colocation services in our data center.Reminder: we recommend enabling backups for additional data protection.A new VPS/VDS lineup with NVMe storage and improved performance is now available.Maintenance work on some servers has been completed. All services are operating normally.
Article4 min readViews0

Oracle releases new Java patch due to eMudhra certificates: what to check in integrations

On October 24, Oracle issued a critical warning, CVE-2026-114820. The new Java patch removes root certificates: who should verify their runtime environment, TLS trust, and API connections.

АльбинаCommunity author★ 147
Comments 0

Illustration: a man in a bright office hallway holds a purple access badge against a glass door reader
In this article

On October 24, 2026, Oracle issued an emergency warning, CVE-2026-114820: new Java updates remove root certificates linked to the eMudhra incident. Oracle rates the severity at 9.1 on the CVSS 3.1 scale, classified as critical. Owners of Java services that connect to payment gateways, CRM systems, email APIs, and other systems via TLS should verify their runtime environment and apply the patch from their provider.

What changed on October 24

The incident involving the keys of eight eMudhra intermediate certificate authorities occurred earlier. The current news is a separate Oracle warning and an expanded protective measure: four root certificates have been removed from the trusted JDK store. These include three emSign certificates and one AAA Certificate Services certificate from Comodo, which is owned by Sectigo. This change affects trust in certificate chains, not a report of a new breach in Java applications.

Oracle assesses the possibility of unauthenticated network exploitation. The risk is tied to trust in certificates: a forged chain can compromise remote party authentication. The warning alone does not confirm that a specific store's connections were intercepted or that its data was compromised.

Versions to check

The Oracle list includes Java SE 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, and 27.0.1.0.2. Also listed are Oracle GraalVM for JDK 17.0.21.0.2 and 21.0.13.0.2, and GraalVM Enterprise Edition 21.3.20.0.2. Earlier versions cannot be considered protected solely because they are absent from the table: Oracle separately warns about limitations when verifying unsupported releases.

For the Oracle JDK 17 branch, the corrected release is confirmed in the official release notes: 17.0.21.0.3+1 dated October 24. It removes the corresponding roots from cacerts. If you have already installed 17.0.21.0.2 after the previous warning, check the new update: version .0.2 is directly included in the list of affected versions. For other Java builds and products with a built-in JRE, a response from their vendor is required, including possible fixes without changing the major version.

Actions for site owners and administrators

  • Compile a list of active Java services and their runtime environments: system Java, containers, and embedded JREs may be updated independently. Also verify individual application trust stores.
  • Back up the configuration and trust store before proceeding. Apply the vendor patch during an appropriate maintenance window, then restart affected processes and confirm they are using the updated environment.
  • After modifying trust settings, verify connections to payment systems, CRM, email services, and other APIs. If a chain error occurs, inspect the remote service's certificate. Do not disable TLS verification or re-add root certificates excluded by the patch to the trust store solely to restore connectivity.
  • If an update is not yet possible, coordinate a temporary mitigation with the security administrator following Oracle's instructions. Modifying the trust store and verifying revocation status require application-specific configuration; a universal command for all production servers is not applicable here.

For a site without Java, this news does not mean you must blindly change PHP or the TLS certificate. What matters is the actual dependency: for example, a separate Java connector may run alongside an online store on a different platform. Updating a package on disk does not replace checking the running process.

Sources and verification time

Information verified on October 25, 2026, at 00:03 MSK. The warning date and the corrected release date are October 24. Application conditions and patch availability should be verified with the provider of the specific build.

Oracle: CVE-2026-114820 warning and list of affected products

Oracle: updated eMudhra certificate instructions

Oracle JDK 17: corrected release notes

GENERAL IT

Help with your project

GENERAL IT

Read more on this topic

Discussion 0

Share your experience and ask questions. Comments without links appear after editorial review.

No comments yet. Start the discussion.