CVE-2026-114820: 
Amazon Corretto JDK 취약점 분석 및 완화

CVE-2026-114820 is a critical vulnerability in the JSSE (Java Secure Socket Extension) component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition, rooted in the use of compromised eMudhra root CA certificates that should have been removed from Java truststores. The vulnerability allows unauthenticated remote attackers to compromise affected Java runtimes via multiple network protocols. Affected versions include Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0.1.0.2; Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2; Oracle GraalVM Enterprise Edition: 21.3.20.0.2. Disclosed on October 24, 2026, it carries a CVSS v3.1 base score of 9.1 (Critical) (Oracle Advisory, GitHub Advisory).

The vulnerability is classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and stems from Java truststores continuing to anchor eMudhra and AAA root CA certificates that have been deemed untrustworthy and should have been removed (GitHub Advisory). Because these root certificates remain trusted, an attacker who controls or can forge certificates chaining to the compromised eMudhra CA can conduct man-in-the-middle attacks against TLS connections, bypassing authentication and certificate validation in the JSSE component (Oracle Advisory). Exploitation can occur through APIs in the JSSE component — for example, via a web service supplying data to those APIs — and also affects Java deployments running sandboxed Java Web Start applications or applets that load untrusted code from the internet. No preconditions such as authentication or user interaction are required; network access alone is sufficient (Oracle Advisory).

Successful exploitation results in high confidentiality and high integrity impact, with no availability impact. An unauthenticated attacker can gain complete read access to all data accessible to the affected Java runtime, as well as the ability to create, delete, or modify critical data accessible to Oracle Java SE, GraalVM for JDK, or GraalVM Enterprise Edition processes (Oracle Advisory). The vulnerability is particularly dangerous in environments where Java applications handle sensitive data over TLS, as the trust anchor compromise enables silent interception and manipulation of encrypted communications. Java Web Start applications and sandboxed applets relying on the Java sandbox for security are also at risk of sandbox escape via malicious code signed with the compromised CA (GitHub Advisory).

No confirmed in-the-wild exploitation has been observed, and no functional exploit code is publicly available; the only public repository associated with this CVE is a read-only Ansible playbook designed to scan for vulnerable Java truststores, not to exploit them (Feedly). The NVD SSVC assessment classifies exploitation as "none" at time of publication, though the vulnerability is rated "automatable" due to its network-accessible, no-authentication-required attack vector (Feedly). There is no current CISA KEV catalog listing for this CVE. The EPSS score is not yet published. Despite the lack of active exploitation, the ease of exploitation (low complexity, no privileges required) and the broad deployment of affected Java versions represent significant latent risk.

1. Reconnaissance: Identify targets running affected Java versions (8u511-b32 through 27.0.1.0.2) using network scanning tools such as Shodan, Censys, or Nmap with Java/TLS fingerprinting scripts.
2. Obtain or forge a certificate: Acquire a TLS certificate signed by the compromised eMudhra CA (or an intermediate CA whose keys are recoverable), which affected Java runtimes will trust due to the retained root certificate.
3. Position for interception: Establish a man-in-the-middle position between the target Java client/server and its intended TLS endpoint using ARP spoofing, DNS poisoning, or BGP hijacking on the relevant network segment.
4. Present the forged certificate: Serve the attacker-controlled certificate during the TLS handshake; the vulnerable JSSE component will accept it as valid because the eMudhra root remains in the truststore.
5. Intercept or manipulate traffic: Decrypt, read, and/or modify data exchanged over the TLS session, achieving unauthorized access to critical data or injecting malicious content into the communication stream (Oracle Advisory, GitHub Advisory).

• Network: Unexpected TLS certificates in traffic to/from Java applications that chain to eMudhra or AAA root CAs; TLS handshakes completing with certificates issued by eMudhra intermediates on connections where such CAs would not be expected.
• File System: Java truststore files (cacerts, jssecacerts) containing entries for eMudhra or AAA root CA certificates after the expected patch date; presence of Ansible playbook artifacts from cve-2026-114820-java-scan on systems indicating scanning activity.
• Logs: Java application logs showing TLS connections accepted with eMudhra-chained certificates; JSSE debug logs (-Djavax.net.debug=ssl) revealing unexpected certificate chain validation paths through eMudhra roots.
• Process: Java processes initiating outbound TLS connections to unexpected endpoints that present eMudhra-signed certificates; Java Web Start or applet processes loading code from untrusted internet sources.

Oracle has released patched Java versions that remove the compromised eMudhra and AAA root CA certificates from the default truststore; users should update to the latest Java SE release beyond the affected versions listed (Oracle Advisory). For systems that cannot be immediately patched, administrators can manually remove the eMudhra and AAA root certificates from Java truststores using the keytool utility (keytool -delete -alias <alias> -keystore $JAVA_HOME/lib/security/cacerts). Oracle also references https://ops.java/emudhra for additional mitigation guidance. As a network-level workaround, restrict outbound and inbound TLS connections from Java applications to known-good endpoints until patches are applied. The Ansible-based scanner at joedayz/cve-2026-114820-java-scan can be used to identify vulnerable truststores across an environment.

The vulnerability received coverage from The Hacker Wire, which described it as an "Oracle Java SE JSSE API Flaw" enabling "unauthenticated data compromise and sandbox escape" (The Hacker Wire). Security researcher suriq.io published a dedicated blog post analyzing the eMudhra CA trust implications and shared it on Bluesky and Mastodon, generating community discussion (suriq.io). The CTI Pilot blog also noted prior reporting on eMudhra intermediate CA key recoverability as context for this vulnerability (ctipilot.ch). Community sentiment on infosec social platforms reflects concern about the broad deployment footprint of affected Java versions, though the absence of a working exploit has tempered urgency somewhat.