CVE-2026-114820: 
Amazon Corretto JDK Schwachstellenanalyse und -minderung

CVE-2026-114820 is a critical vulnerability in the JSSE (Java Secure Socket Extension) component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, rooted in the continued trust of compromised eMudhra Certificate Authority (CA) root certificates. The vulnerability allows unauthenticated network attackers to compromise affected Java runtimes, resulting in unauthorized access to or modification of critical data. Affected versions include Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. It was disclosed on October 24, 2026, with a CVSS v3.1 base score of 9.1 (Critical) (Oracle Advisory, GitHub Advisory).

The vulnerability is classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and stems from Java truststores continuing to anchor eMudhra and AAA CA root certificates whose private keys were found to be recoverable or compromised (GitHub Advisory). Because these CA roots remain trusted in affected JVM versions, an attacker who controls or can forge certificates signed by the compromised eMudhra CA can conduct man-in-the-middle (MitM) attacks against TLS connections, bypass certificate validation, or impersonate trusted services — all without requiring authentication. The attack is exploitable via multiple protocols through JSSE APIs, including through web services that supply data to those APIs, and also affects sandboxed Java Web Start applications and applets that load untrusted code from the internet (Oracle Advisory). Technical context on the eMudhra CA compromise and its implications for JVM trust stores has been documented by independent researchers (glaforge.dev, suriq.io).

Successful exploitation allows an unauthenticated remote attacker to achieve high confidentiality and high integrity impact against all data accessible to the affected Java runtime — including reading sensitive application data and creating, modifying, or deleting critical data — with no availability impact (Oracle Advisory). The scope extends beyond core Java SE to Oracle Database Server (versions 19.3–19.32, 21.3–21.23, 23.4.0–23.26.3), Oracle Autonomous Health Framework (versions 26.3–26.10), Oracle Global Lifecycle Management OPatch, Oracle Hospitality Cruise SPMS, and any other Oracle products that bundle or embed Java (Oracle Advisory). In environments relying on TLS for inter-service communication, exploitation could enable lateral movement through MitM interception of encrypted traffic, credential theft, and session hijacking.

No confirmed weaponized exploit or in-the-wild exploitation has been reported as of the time of disclosure; the EPSS score is approximately 0.25% (17th percentile), indicating a currently low but non-negligible probability of exploitation in the near term (GitHub Advisory). A public GitHub repository (joedayz/cve-2026-114820-java-scan) exists but is a read-only Ansible detection playbook that scans for vulnerable Java truststores rather than an exploit — Feedly assessed it as non-exploitable with high confidence (Feedly). The vulnerability is rated as "automatable" by NVD SSVC, meaning exploitation could be scripted at scale. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Qualys (detection IDs 389155–389159) and Nessus (plugin IDs 374381, 374396) have released detection signatures (Feedly).

1. Identify vulnerable targets: Use network scanning tools (e.g., Nessus plugin 374381, Qualys detection 389155–389159) to identify systems running affected Java SE, GraalVM, or Oracle products with unpatched truststores still containing eMudhra/AAA CA roots.
2. Obtain or forge a certificate: Leverage the compromised eMudhra CA private keys (which are publicly known to be recoverable) to issue a fraudulent TLS certificate for a target domain or service.
3. Position for MitM: Place the attacker-controlled system in a network position to intercept TLS traffic between a Java client and a server (e.g., via ARP spoofing, DNS poisoning, or BGP hijacking on the relevant network segment).
4. Present the forged certificate: When the Java client initiates a TLS handshake, present the fraudulent certificate signed by the compromised eMudhra CA. The vulnerable JVM will validate it as trusted because the eMudhra root remains in its truststore.
5. Intercept and manipulate traffic: Decrypt, read, and optionally modify the plaintext application data flowing through the now-compromised TLS session, achieving unauthorized data access (confidentiality) and data manipulation (integrity) (Oracle Advisory, suriq.io).

• Network: Unexpected TLS connections where the server certificate chains to an eMudhra or AAA CA root; TLS handshakes presenting certificates issued by eMudhra intermediates to Java-based clients; anomalous traffic patterns suggesting MitM interception on internal network segments.
• File System: Java truststore files (cacerts, jssecacerts) that still contain eMudhra or AAA root CA entries (detectable via keytool -list -keystore <truststore> and checking for eMudhra aliases); presence of the Ansible detection playbook (cve-2026-114820-java-scan) indicating active scanning of the environment.
• Logs: TLS handshake logs showing certificate chains rooted in eMudhra CAs for connections to services that should not use such certificates; Java application logs showing unexpected certificate validation successes for domains not legitimately issued by eMudhra.
• Process/Configuration: JVM versions matching affected releases (8u511-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2) still in use after patch availability; scanner alerts from Qualys (IDs 389155–389159) or Nessus (IDs 374381, 374396) flagging unpatched Java installations (Feedly).

Oracle has released patched Java versions that remove the compromised eMudhra and AAA CA root certificates from the default truststore; organizations should update to the next available Java release beyond the affected versions listed (Oracle Advisory). Red Hat has issued corresponding errata (RHSA-2026:88348 through 88352, 90504, 90912) for OpenJDK packages on RHEL, and Eclipse Temurin has released updated builds (17.0.21, 21.0.13, 25.0.5, 27.0.1) (Adoptium). Amazon Linux 2023 (ALAS2023-2026-3371), Amazon Linux 2 (ALAS2-2026-4066), and Amazon Corretto 8 (ALAS2CORRETTO8-2026-027) patches are also available. As an interim workaround, administrators can manually remove the eMudhra root CA entries from Java truststores using keytool -delete -alias <emudhra-alias> -keystore $JAVA_HOME/lib/security/cacerts. JetBrains has also released IDE updates addressing the compromised certificates in bundled JDKs (JetBrains Blog).

Oracle issued a dedicated out-of-band Security Alert (separate from the regular Critical Patch Update cycle) for CVE-2026-114820, underscoring the severity of the eMudhra CA compromise (Oracle Advisory). Azul published a blog post titled "Java Patching at Incident Speed: Lessons from the eMudhra CA Compromise," highlighting the operational challenges of emergency Java truststore updates (Azul Blog). Independent researchers at suriq.io and glaforge.dev published detailed technical analyses of the eMudhra CA key compromise and its implications for JVM security (suriq.io, glaforge.dev). The JVM Weekly newsletter and security community on Mastodon (infosec.exchange) also discussed the vulnerability, with the Water ISAC including it in their weekly vulnerability prioritization list for October 29, 2026.