The eMudhra case: two critical Java vulnerabilities in four days

In our previous article we explained why quarterly Java patching is no longer enough. October 2026 delivered a concrete example. Three updates shipped within five days, two of them out-of-cycle and rated CVSS 9.1.

What happened

On October 20, 2026, it became public that the private keys of eight eMudhra intermediate CA certificates were compromised. The keys had been generated defectively, so according to Azul's statement anyone could derive them from the public certificates.

The certificates chained to roots trusted by major browsers and operating systems. According to a community tracker of the incident, an attacker holding such a key could impersonate any website or service. Apple, Google, Microsoft, and Mozilla blocked the certificates.

Why Java is affected too

Java has its own trust store and, according to Azul, does not check certificate revocation by default. eMudhra revoking the certificates therefore does not by itself help a running JDK. Until the JDK is updated, it may keep trusting them.

OpenJDK issued two security advisories as a result:

Five days in October

Azul's release dates according to Azul's overview:

• October 20: the quarterly security-only update within an hour of disclosure, closing a record 53 CVEs.
• October 21: the first out-of-cycle fix (CVE-2026-91403), in under 24 hours. According to Azul's statement, it shipped for Zulu builds of Java 27, 25, 21, 17, 11, 8, 7, and 6 and for Azul Prime 25, 21, 17, 11, and 8.
• October 24: the second out-of-cycle fix (CVE-2026-114820).

What to do now

The steps follow OpenJDK's guidance, which also has the exact commands:

1. Check your status. OpenJDK provides a CheckCerts.java program that works on JDK 8 and later.
2. Update the runtime. This is the preferred route. Release notes should list fix JDK-8395690 and CVE-2026-114820. For Azul, that means a build from October 24 or later.
3. Can't update right away? As a stopgap, you can remove the affected root certificates from cacerts or enable revocation checking. Azul recommends manual changes only as a short-term measure. Back up cacerts first and restart running instances afterwards. Removing the roots, including AAA Certificate Services, can break connections to services that chain to them, so test it first.
4. Debian and derivatives (including Ubuntu): updating the certificate packages alone is not sufficient. A manual step described on the OpenJDK page is required.

Remember Java in containers, in third-party applications, and on build agents. A bundled JDK does not change when the operating system is updated.

Was it exploited?

We found no report of exploitation in the wild in the sources we reviewed. According to eMudhra, only one of the eight certificates was used in production and none issued end-entity certificates. According to Azul's statement, Google found no certificates chaining to them in Certificate Transparency logs.

That is no reason to delay the update. Anyone could derive the key, and the community tracker notes that targeted attacks on clients that do not enforce Certificate Transparency cannot be ruled out.

What this means for your patch cycle

The biggest problem was not the vulnerability itself but the timing. A team that was just testing the October quarterly update received two more within four days. If every patch means a full regression run, a series like that cannot be kept up with.

That is why it makes sense to separate security fixes from other changes. Azul does this with security-only updates: according to Azul they carry minimal regression risk, so they can be deployed quickly, while full quarterly updates are tested in pre-production in the meantime. Actual rollout still depends on your own process. For comparison, Verizon DBIR 2026 reports a 43-day median to full remediation of KEV vulnerabilities.

Do you know where you stand?

The free Java Security Assessment helps you see how many JVMs are still below the current patch level. It works from an overview of Java versions and quantities, anonymized and with no names.

Request the free assessment. Everything goes through us.