- Oracle Java vulnerabilities could let a remote attacker bypass security restrictions and manipulate data on a targeted system.
- Affected software includes Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition versions listed by HKCERT.
- HKCERT told users to apply fixes issued by Oracle through its security alerts.
Oracle Java is affected by vulnerabilities that could let a remote attacker bypass security restrictions and manipulate data on a targeted system, HKCERT said in an advisory published on Oct 22, 2026.
The affected products include Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition.
HKCERT also said multiple Oracle product vulnerabilities could enable denial of service, privilege elevation, security restriction bypass, sensitive information disclosure and remote code execution on a targeted system.
On this page
Oracle’s Java update distrusts eMudhra certificates
Oracle said the update for CVE-2026-91403 distrusts the set of impacted intermediate certificate authority certificates related to eMudhra. The company said the security alert contains one new security patch for Oracle Java SE.
Oracle’s alert credited no person or organization with reporting the vulnerabilities it addressed.
HKCERT lists Java and GraalVM versions affected
HKCERT lists Oracle GraalVM Enterprise Edition 21.3.20 and 21.3.20.0.2 among the affected technologies. It also lists Oracle GraalVM for JDK 17.0.21, 21.0.13, 17.0.21.0.2 and 21.0.13.0.2.
For Oracle Java SE, the affected versions are 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1.
| Product | Versions |
|---|---|
| Oracle GraalVM Enterprise Edition | 21.3.20; 21.3.20.0.2 |
| Oracle GraalVM for JDK | 17.0.21; 21.0.13; 17.0.21.0.2; 21.0.13.0.2 |
| Oracle Java SE | 8u511; 8u511-perf; 11.0.33; 17.0.21; 21.0.13; 25.0.5; 27.0.1 |
HKCERT points users to Oracle’s security alerts
HKCERT told users to apply fixes issued by Oracle through the security alerts for CVE-2026-91403 and CVE-2026-114820. For other Oracle products, it directed readers to Oracle’s October 2026 Critical Patch Update.
HKCERT updated its description, affected technologies, solutions and related links on Oct 26, 2026. It directed users to apply fixes issued by Oracle through the listed security alerts.
Oracle said its alert contains one new security patch for Oracle Java SE. It did not credit any person or organization with reporting the vulnerabilities addressed by the alert.
What to do now
- Apply fixes issued by the vendor through the Oracle security alerts for CVE-2026-91403 and CVE-2026-114820.
FAQ
What happened with the Oracle Java vulnerabilities?
HKCERT said multiple Oracle Java vulnerabilities could let a remote attacker bypass security restrictions and manipulate data on a targeted system.
Which Oracle Java versions are affected?
HKCERT lists affected versions of Oracle Java SE, Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition.
How do I fix the Oracle Java vulnerabilities?
HKCERT says to apply fixes issued by Oracle through the security alerts for CVE-2026-91403 and CVE-2026-114820.
What did Oracle change for CVE-2026-91403?
Oracle said its Java updates distrust the set of impacted intermediate certificate authority certificates related to eMudhra.
Sources
- Oracle Java Security Restriction Bypass Vulnerability, HKCERTPrimary
- Oracle Products Multiple Vulnerabilities, HKCERTPrimary
- Oracle Security Alert Advisory - CVE-2026-91403, OraclePrimary
- Hackers Start Probing Fresh Oracle EBS Vulnerability, SecurityWeek
- Java security work is becoming a daily operational burden, Help Net Security
- Mixed Reviews on Oracle’s Java Security Update, Threatpost
How we checked this story
| Claim | Source | Status |
|---|---|---|
| HKCERT said multiple Oracle Java vulnerabilities could let a remote attacker bypass security restrictions and manipulate data on a targeted system. | HKCERT | Confirmed |
| HKCERT updated its description, affected technologies, solutions and related links on 26 October 2026. | HKCERT | Confirmed |
| The affected Oracle GraalVM Enterprise Edition versions are 21.3.20 and 21.3.20.0.2. | HKCERT | Confirmed |
| The affected Oracle GraalVM for JDK versions are 17.0.21, 21.0.13, 17.0.21.0.2 and 21.0.13.0.2. | HKCERT | Confirmed |
| The affected Oracle Java SE versions are 8u511, 8u511-perf, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1. | HKCERT | Confirmed |
| Oracle said its update for CVE-2026-91403 distrusts impacted intermediate certificate authorities related to eMudhra. | Oracle | Confirmed |
| Oracle said the security alert contains one new security patch for Oracle Java SE. | Oracle | Confirmed |
| Oracle said no person or organization was credited with reporting the vulnerabilities addressed by the security alert. | Oracle | Confirmed |
| HKCERT said multiple Oracle product vulnerabilities could enable denial of service, privilege elevation, security restriction bypass, information disclosure and remote code execution. | HKCERT | Confirmed |
| HKCERT directed readers to Oracle’s October 2026 Critical Patch Update for other Oracle products. | HKCERT | Confirmed |
| SecurityWeek reported that threat actors had begun probing a newly patched critical Oracle E-Business Suite vulnerability, according to Defused. | SecurityWeek | Attributed |
| SecurityWeek reported that CVE-2026-101767 has a CVSS score of 9.8 and was patched in Oracle’s October Critical Patch Update. | SecurityWeek | Attributed |
| Defused said its Oracle E-Business Suite decoys recorded exploratory exploitation attempts against CVE-2026-101767 on 27 October. | Defused, via SecurityWeek | Attributed |
| SecurityWeek reported that Defused had warned in June about attacks exploiting CVE-2026-46817 in Oracle E-Business Suite’s Payments product. | Defused, via SecurityWeek | Attributed |
| SecurityWeek reported that Cl0p exploited zero-day flaws in Oracle enterprise management software last year to access stored data. | SecurityWeek | Attributed |
| SecurityWeek reported that the large-scale Oracle E-Business Suite campaign potentially affected more than 100 organizations across many industries. | SecurityWeek | Attributed |
| Help Net Security reported that 64% of more than 2,000 surveyed Java professionals said over half their organizations’ applications or workloads use Java or a JVM. | Help Net Security | Attributed |
| Help Net Security reported that 30% of respondents said DevOps teams spend more than half their time handling JVM vulnerability false positives. | Help Net Security | Attributed |
| Help Net Security reported that 92% of respondents were concerned about Oracle Java pricing. | Help Net Security | Attributed |
| Help Net Security reported that 81% of respondents had migrated, were migrating or planned to migrate Oracle Java workloads to non-Oracle OpenJDK distributions. | Help Net Security | Attributed |
| Help Net Security reported that 30% of respondents said AI code-generation tools produced more than half their new Java application code. | Help Net Security | Attributed |
| Threatpost reported that Java sandbox vulnerabilities had been particularly successful targets for attackers. | Threatpost | Attributed |
| Threatpost quoted HD Moore saying a signed malicious applet could still exploit JRE flaws to escape the sandbox and compromise a system without process-level sandboxing. | HD Moore, via Threatpost | Attributed |
| Threatpost reported that Oracle planned to include Java security updates in its quarterly Critical Patch Update schedule starting in October. | Threatpost | Attributed |
| Threatpost reported that Oracle changed signed applets so signing establishes identity but does not necessarily grant additional privileges. | Oracle, via Threatpost | Attributed |
| Threatpost reported that Oracle changed default settings so unsigned or self-signed applets became the norm. | Threatpost | Attributed |
| HKCERT published its report on Oct 22, 2026. | HKCERT | Confirmed |
Could not verify
- Whether CVE-2026-114820 has a separate Oracle advisory is not established.
- Whether either Java vulnerability has been exploited in the wild is not established.
- How many systems or users are affected is not established.
- Whether CVE-2026-91403 and CVE-2026-114820 are related is not established.
Related stories
Vulns & PatchesCitrix discloses critical NetScaler zero-days after exploitation reports
Vulns & PatchesPTC Windchill and FlexPLM flaw could enable remote code execution
Vulns & PatchesN-able takes hosted N-central offline after researcher discloses flaws