Oracle and Cisco ship fixes that stop trusting eMudhra certificates

Oracle and Cisco ship fixes that stop trusting eMudhra certificates

24 October 2026: Oracle has issued an out-of-cycle Security Alert, CVE-2026-114820, that removes the root certificates tied to eMudhra from Java and scores the exposure 9.1 out of 10, remotely exploitable without a login. A day earlier Cisco began publishing its own list of products that must stop trusting eMudhra, with Duo gateway upgrades available now and router and camera firmware due in November.

Not yet independently verified. Oracle's mitigation page (ops.java/emudhra) answered with an outage notice when we read it, and its Patch Availability Document sits behind a support sign-in, so the exact build numbers that remove the roots are not quoted here. Cisco's advisory is still being updated product by product. We will update this when it can be confirmed, and remove this note.

Both moves follow the compromise of eight eMudhra intermediate certificate authorities. Cisco's advisory, first published on 23 October at 16:00 GMT and revised on 24 October, says a researcher showed that the private keys for those eight intermediates were "fundamentally broken" by an error in their key generation ceremony in April 2025, so that anyone could recover them "within seconds". Between 17 and 20 October the compromise came to light; we covered the revocations and the Go distrust and eMudhra's exit from the global TLS business earlier this week.

Why a certificate problem becomes a Java CVE

Java ships its own trust store, the cacerts file, and the Java Secure Socket Extension (JSSE) uses it to decide which TLS servers to believe. While eMudhra's roots stay in that file, a Java client will accept a certificate minted with one of the exposed intermediate keys, which is what lets an attacker impersonate a server and read or alter the traffic. Oracle rates confidentiality and integrity impact high and availability impact none, with low attack complexity and no user interaction.

Oracle's alert says it addresses the CVE "by providing Java updates which removes the set of impacted root CA certificates related to eMudhra", and tells customers to update to the latest Java version or apply its recommended mitigations. The note in the risk matrix adds that the flaw can be reached through any web service that feeds data to the affected APIs, and through sandboxed Java Web Start applications or applets that run untrusted code.

The Java builds Oracle lists

The alert names these supported versions as affected:

• Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2 and 27.0.1.0.2
• Oracle GraalVM for JDK: 17.0.21.0.2 and 21.0.13.0.2
• Oracle GraalVM Enterprise Edition: 21.3.20.0.2

These are the newest bundled patch builds of each line, so a fully patched JDK from the October cycle is still exposed until the alert's update is applied. Oracle patches only lines in Premier or Extended Support and warns that older releases are likely affected too. Teams that run OpenJDK builds from another vendor, or that pin their own trust store, need to check that vendor's notice or remove the eMudhra entries themselves; a container image built before this week carries the old cacerts file until it is rebuilt.

Cisco's dates, product by product

Cisco's table splits its estate three ways. Duo, Secure Access and the Meraki Dashboard are fixed or being fixed in the cloud with no customer action. Several on-premises products need an upgrade:

• Duo Access Gateway 3.2.0, released 21 October
• Duo Network Gateway 3.4.1, released 22 October
• Duo Agentic Authorization Connector 1.0.1
• Application-hosting Agent 5.2.2 for ThousandEyes Enterprise Agent, targeted for 23 October
• Meraki MV Smart Camera firmware, due 18 November
• IOS XR Software 26.4.1, due 30 November
• Ultra Cloud Core Subscriber Microservices Infrastructure 2026.04.1, due in November

Secure Firewall Management Center gets a workaround rather than a fix: a TechZone article on configuring its TLS policy to block known eMudhra issuers. A long list remains under investigation, among them Identity Services Engine, Secure Firewall ASA and Threat Defense, Secure Web Appliance and Secure Network Analytics. Cisco says a product missing from the advisory has been reviewed and found unaffected.

Gaps between now and the November builds

For IOS XR and Meraki cameras the fix is five weeks away, so the interim control is upstream: blocking eMudhra-issued certificates at a TLS inspection point, where one exists. Our patch management software category lists seven products and our cybersecurity software category nine. Oracle's own JDK 25.0.5 release notes say it does not recommend using that build after the next Critical Patch Update, scheduled for 17 November 2026.

Related on TrustList:

• Oracle's October update brings 1,295 patches and a 9.8 E-Business Suite flaw
• Oracle patches a CVSS 9.1 Java TLS flaw in an out-of-cycle alert
• Apache Tomcat fixes a JNDIRealm password bypass and HTTP/2 mix-up

Sources

• Oracle: Security Alert Advisory, CVE-2026-114820 (Rev 1), 24 October 2026
• Cisco: Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities, cisco-sa-emudhra-info-ScS22A1r (version 1.1), 24 October 2026
• Oracle: JDK 25.0.5 release notes (read 2026-10-25), 25 October 2026