Oracle and Cisco ship fixes that stop trusting eMudhra certificates

Oracle and Cisco ship fixes that stop trusting eMudhra certificates

24 October 2026: Oracle has issued an out-of-cycle Security Alert, CVE-2026-114820, that removes the root certificates tied to eMudhra from Java and scores the exposure 9.1 out of 10, remotely exploitable without a login. A day earlier Cisco began publishing its own list of products that must stop trusting eMudhra, with Duo gateway upgrades available now and router and camera firmware due in November.

Not yet independently verified. Oracle's alert (revision 2, 30 October 2026) lists the affected Java builds, but we have not read its Patch Availability Document, which needs a support sign-in. Cisco's advisory is still being updated product by product; we read version 1.9 of 10 November 2026. We will update this when it can be confirmed, and remove this note.

Both moves follow the compromise of eight eMudhra intermediate certificate authorities. Cisco's advisory, first published on 23 October at 16:00 GMT and revised on 24 October, says a researcher showed that the private keys for those eight intermediates were "fundamentally broken" by an error in their key generation ceremony in April 2025, so that anyone could recover them "within seconds". Between 17 and 20 October the compromise came to light; we covered the revocations and the Go distrust and eMudhra's exit from the global TLS business earlier this week.

Update, 11 November 2026: Oracle revised its alert on 30 October (revision 2), adding Oracle Autonomous Health Framework, Database Server, Global Lifecycle Management OPatch and Hospitality Cruise SPMS to the affected products; the Java builds it lists are unchanged. Cisco's advisory, now at version 1.9 of 10 November, gives dates for products it had listed as under investigation: Identity Services Engine 3.5P5 in December 2026 and 3.3P13 and 3.4P8 in April 2027, Intersight Virtual Appliance 1.1.8-2 in November 2026, and IP Phone 8800 firmware 14.4(1)ES1 on 13 November 2026 and 14.4(1)SR5 in January 2027. IOS XR 26.4.1 is still due on 30 November.

Why a certificate problem becomes a Java CVE

Java ships its own trust store, the cacerts file, and the Java Secure Socket Extension (JSSE) uses it to decide which TLS servers to believe. While eMudhra's roots stay in that file, a Java client will accept a certificate minted with one of the exposed intermediate keys, which is what lets an attacker impersonate a server and read or alter the traffic. Oracle rates confidentiality and integrity impact high and availability impact none, with low attack complexity and no user interaction.

Oracle's alert says it addresses the CVE "by providing Java updates which removes the set of impacted root CA certificates related to eMudhra", and tells customers to update to the latest Java version or apply its recommended mitigations. The note in the risk matrix adds that the flaw can be reached through any web service that feeds data to the affected APIs, and through sandboxed Java Web Start applications or applets that run untrusted code.

The Java builds Oracle lists

The alert names these supported versions as affected:

• Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 and 27.0.1.0.2
• Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2
• Oracle GraalVM Enterprise Edition: 21.3.20.0.2

These are the newest bundled patch builds of each line, so a fully patched JDK from the October cycle is still exposed until the alert's update is applied. Oracle patches only lines in Premier or Extended Support and warns that older releases are likely affected too. Teams that run OpenJDK builds from another vendor, or that pin their own trust store, need to check that vendor's notice or remove the eMudhra entries themselves; a container image built before this week carries the old cacerts file until it is rebuilt.

Cisco's dates, product by product

Cisco's table splits its estate three ways. Duo, Secure Access and the Meraki Dashboard are fixed or being fixed in the cloud with no customer action. Several on-premises products need an upgrade:

• Duo Access Gateway 3.2.0, released 21 October
• Duo Network Gateway 3.4.1, released 22 October
• Duo Agentic Authorization Connector 1.0.1
• Application-hosting Agent 5.2.2 for ThousandEyes Enterprise Agent, targeted for 23 October
• Meraki MV Smart Camera firmware, due 18 November
• IOS XR Software 26.4.1, due 30 November
• Ultra Cloud Core Subscriber Microservices Infrastructure 2026.04.1, due in November

Secure Firewall Management Center gets a workaround rather than a fix: a TechZone article on configuring its TLS policy to block known eMudhra issuers. A long list remains under investigation, among them Identity Services Engine, Secure Firewall ASA and Threat Defense, Secure Web Appliance and Secure Network Analytics. Cisco says a product missing from the advisory has been reviewed and found unaffected.

Gaps between now and the November builds

For IOS XR and Meraki cameras the fix is five weeks away, so the interim control is upstream: blocking eMudhra-issued certificates at a TLS inspection point, where one exists. Our patch management software category lists seven products and our cybersecurity software category nine. Oracle's own JDK 25.0.5 release notes say it does not recommend using that build after the next Critical Patch Update, scheduled for 17 November 2026.

Related on TrustList:

• Oracle's October update brings 1,295 patches and a 9.8 E-Business Suite flaw
• PeopleSoft attacks are back and slip past WAF rules: Oracle’s June patch for CVE-2026-35273 is the only fix

Sources

• Oracle: Security Alert Advisory, CVE-2026-114820 (Rev 2), 30 October 2026
• Cisco: Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities, cisco-sa-emudhra-info-ScS22A1r (version 1.9), 10 November 2026
• Oracle: JDK 25.0.5 release notes (read 2026-10-25), 25 October 2026