CVE-2026-114820: 
Amazon Corretto JDK 脆弱性分析と緩和策

CVE-2026-114820 is a cryptographic trust vulnerability in the JSSE (Java Secure Socket Extension) component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, stemming from the compromise of eMudhra Certificate Authority (CA) root certificates. The vulnerability requires Oracle to remove the impacted eMudhra and AAA root CA certificates from Java's trusted certificate store. Affected versions include Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Disclosed on October 24, 2026, it carries a CVSS v3.1 base score of 9.1 (Critical) (Oracle Advisory, GitHub Advisory).

The root cause is classified as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm), specifically the continued trust of eMudhra CA root certificates whose private keys were found to be recoverable or compromised, enabling fraudulent certificate issuance (GitHub Advisory, Oracle Advisory). An unauthenticated network attacker can exploit this by presenting TLS certificates signed by the compromised eMudhra CA roots, which Java's JSSE component would incorrectly trust, enabling man-in-the-middle (MitM) attacks against TLS-protected communications. The vulnerability is exploitable via any protocol that uses Java's JSSE for certificate validation, including through web services that supply data to JSSE APIs, as well as sandboxed Java Web Start applications and applets that load untrusted code from the internet. The attack complexity is low and requires no privileges or user interaction, making it highly automatable (Oracle Advisory).

Successful exploitation allows an unauthenticated remote attacker to achieve high confidentiality and high integrity impact against all data accessible to the affected Java runtime — including unauthorized reading of sensitive data and unauthorized creation, deletion, or modification of critical data. The vulnerability enables MitM attacks against TLS connections validated by Java's JSSE, potentially exposing credentials, session tokens, and application data in transit. The scope extends beyond core Java SE to Oracle Database Server (versions 19.3–19.32, 21.3–21.23, 23.4.0–23.26.3), Oracle Autonomous Health Framework, Oracle Global Lifecycle Management OPatch, Oracle Hospitality Cruise SPMS, and any other Oracle products bundling affected Java versions (Oracle Advisory).

No confirmed in-the-wild exploitation has been observed, and no functional exploit code exists — the only public repository (GitHub PoC) is a read-only Ansible playbook for scanning Java truststores for the presence of the removed eMudhra roots, not an exploit (Feedly). The EPSS score is 0.00253 (low probability of exploitation in the near term). The vulnerability is rated as automatable by NVD SSVC, meaning exploitation could be scripted at scale once a threat actor obtains or forges certificates from the compromised CA. The CVE status remains "Awaiting Analysis" and has not been added to the CISA KEV catalog as of the time of this report (Feedly).

1. Obtain a fraudulent certificate: Leverage the compromised eMudhra CA private keys (which were found to be recoverable) to issue a fraudulent TLS certificate for a target domain (e.g., a banking site, enterprise application, or API endpoint).
2. Position for MitM: Set up a network interception point (e.g., via ARP spoofing, DNS hijacking, or BGP hijacking) between a victim running a vulnerable Java version and the target server.
3. Present the fraudulent certificate: Serve the attacker-controlled TLS certificate signed by the compromised eMudhra root to the victim's Java client during the TLS handshake.
4. Exploit JSSE trust: The victim's vulnerable Java JSSE component validates the certificate against its truststore, which still contains the compromised eMudhra root CA, and accepts the connection as legitimate.
5. Intercept or modify traffic: Decrypt, read, and optionally modify the TLS-protected communication between the victim and the intended server, achieving unauthorized data access or integrity violation (Oracle Advisory, GitHub Advisory).

• File System: Java truststore files (cacerts, jssecacerts) still containing eMudhra or AAA root CA certificates after the patch release date (October 24, 2026); use the Ansible scanner at GitHub to identify unpatched truststores.
• Network: TLS certificates presented to Java clients with issuer chains rooted in eMudhra CA roots (fingerprints available via OpenJDK's eMudhra advisory at openjdk.org/emudhra); unexpected TLS certificate changes for known-good domains when observed from Java-based clients.
• Logs: Java application logs showing TLS handshake completions with certificates issued by eMudhra-rooted CAs after the patch date; JSSE debug output (-Djavax.net.debug=ssl) revealing trust chain validation against removed roots.
• Process: Java processes running versions listed as affected (8u511-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2) that have not been updated post-October 24, 2026.

Oracle has released patched Java versions that remove the compromised eMudhra and AAA root CA certificates from the Java truststore; users should update to the next available patch release beyond the affected versions listed above (Oracle Advisory). Eclipse Temurin (Adoptium) has released updated builds for Java 17.0.21, 21.0.13, 25.0.5, and 27.0.1 addressing this issue (Adoptium). Red Hat has issued multiple errata (RHSA-2026:88348 through RHSA-2026:94499) for OpenJDK on RHEL, and Amazon Linux has released updates via ALAS advisories. As a workaround for systems that cannot be immediately patched, administrators can manually remove the eMudhra root certificates from Java truststores using keytool -delete, or restrict network access to Java-based services until patching is complete (Oracle Advisory, GitHub Advisory).

Oracle published a dedicated Security Alert page and referenced ops.java/emudhra for additional technical context, with the advisory updated on October 30, 2026 to include additional affected Oracle products (Oracle Advisory). Azul Systems published a blog post titled "Java Patching at Incident Speed: Lessons from the eMudhra CA Compromise," highlighting the operational challenges of rapid truststore updates across JDK distributions (Azul Blog). JetBrains issued a vendor advisory addressing compromised eMudhra certificates in their IDEs, and Elastic published a security update for Logstash (ESA-2026-228) related to the same CA compromise. Security researchers on Mastodon (infosec.exchange) and Bluesky discussed the trust implications, and suriq.io published a detailed blog post on the eMudhra CA trust issue. The WaterISAC included this CVE in its weekly vulnerability prioritization report for October 29, 2026.