CVE-2026-113470: 
Amazon Corretto JDK vulnerability analysis and mitigation

CVE-2026-113470 is a cryptographic issue (improper certificate validation) in Mozilla Firefox's Security Block-lists, Allow-lists, and other State component, stemming from compromised intermediate eMudhra Certificate Authority certificates. Mozilla initially blocked the compromised certificates via OneCRL on October 17, 2026, distributed through RemoteSettings; however, clients with RemoteSettings disabled by policy or network restrictions would not receive the block. The vulnerability was publicly disclosed on October 20, 2026, and affects Firefox versions prior to 158.0.1, Firefox ESR prior to 153.5.1, and Firefox ESR prior to 115.43.1. It carries a CVSS v3.1 base score of 5.4 (Medium) (Mozilla Advisory mfsa2026-111, Mozilla Advisory mfsa2026-112, Mozilla Advisory mfsa2026-113).

The root cause is classified as CWE-295 (Improper Certificate Validation): Firefox's OneCRL certificate revocation mechanism relies on RemoteSettings to distribute blocklist updates to clients, but when RemoteSettings is disabled by enterprise policy or is otherwise unreachable, the browser fails to enforce the revocation of the compromised eMudhra intermediate CA certificates. This creates a window where Firefox clients would continue to trust TLS certificates issued by the compromised eMudhra intermediates, enabling potential man-in-the-middle (MitM) attacks. The attack requires user interaction (a victim visiting a site presenting a fraudulent certificate) and network-level positioning by the attacker, mapping to CAPEC-459 (Creating a Rogue Certification Authority Certificate) and CAPEC-475 (Signature Spoofing by Improper Validation) (Mozilla Advisory mfsa2026-111, Mozilla Advisory mfsa2026-112).

Successful exploitation allows an attacker with a certificate signed by the compromised eMudhra intermediate CA to impersonate trusted HTTPS services, intercepting or modifying encrypted communications between the victim and legitimate websites. This results in limited confidentiality and integrity impacts — an attacker could read or alter sensitive data in transit (e.g., credentials, session tokens, personal information) for users whose Firefox clients have not received the OneCRL update via RemoteSettings. Availability is not directly impacted, and the scope is limited to the affected client session (Mozilla Advisory mfsa2026-111, Mozilla Advisory mfsa2026-112).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-113470 as of the disclosure date. The EPSS score is 0.0 and NVD's SSVC assessment indicates exploitation is "none" and the vulnerability is not automatable, reflecting the requirement for attacker network positioning and user interaction. The vulnerability is not listed in the CISA KEV catalog. The primary risk is theoretical MitM abuse of the compromised eMudhra CA certificates in environments where Firefox's RemoteSettings is blocked (Mozilla Advisory mfsa2026-111, Feedly).

1. Obtain a fraudulent certificate: Acquire or generate a TLS certificate signed by one of the compromised eMudhra intermediate CA certificates (which were compromised prior to October 17, 2026).
2. Identify vulnerable targets: Identify Firefox users in environments where RemoteSettings is disabled by enterprise policy or blocked at the network level, meaning their browsers have not received the OneCRL blocklist update.
3. Position for MitM: Gain a network-level position between the target user and the intended HTTPS destination (e.g., via ARP spoofing, DNS hijacking, or rogue Wi-Fi access point).
4. Present fraudulent certificate: Intercept the victim's HTTPS connection and present the fraudulent certificate signed by the compromised eMudhra intermediate CA. The unpatched Firefox client will accept it as valid since the revocation entry is absent from its local OneCRL.
5. Intercept or modify traffic: Decrypt, read, or modify the victim's encrypted communications, potentially harvesting credentials, session tokens, or other sensitive data (Mozilla Advisory mfsa2026-111, Mozilla Advisory mfsa2026-112).

• Network: Unexpected TLS certificates presented by servers claiming to be legitimate services but signed by eMudhra intermediate CA certificates (check certificate chain for eMudhra issuer); anomalous SSL/TLS interception on network traffic.
• Logs: Firefox browser logs or enterprise proxy logs showing TLS connections accepted with eMudhra-issued intermediate certificates after October 17, 2026, on unpatched clients.
• Configuration: Firefox installations with RemoteSettings disabled via enterprise policy (security.remote_settings.disabled or equivalent group policy) and browser version below 158.0.1 / ESR 153.5.1 / ESR 115.43.1.

Mozilla has released patched versions that embed the updated OneCRL blocklist directly, ensuring the compromised eMudhra certificates are blocked regardless of RemoteSettings availability: Firefox 158.0.1, Firefox ESR 153.5.1, and Firefox ESR 115.43.1. Organizations should prioritize upgrading all Firefox installations to these versions, especially in environments where RemoteSettings is disabled by policy. As an interim measure, administrators can ensure RemoteSettings is not blocked so that the OneCRL update distributed on October 17, 2026, is received by all clients (Mozilla Advisory mfsa2026-111, Mozilla Advisory mfsa2026-112, Mozilla Advisory mfsa2026-113).

The Hacker News covered the broader eMudhra CA key compromise incident in an article titled "Eight eMudhra CA Keys Compromised" (The Hacker News), highlighting the significance of the CA compromise event. The vulnerability was also discussed on the oss-security mailing list (oss-sec). Red Hat tracked the issue via their security advisory process (Red Hat), indicating downstream Linux distribution impact for Firefox packages.