Vulnerability Alert

Java Runtime Trusts Compromised CA Certificates

Severity: Not directly affected

Date: November 2, 2026

Products: Assessed for supported Bravura Security Fabric versions 12.7, 12.8, 12.9 and 12.10.

 

CVE-2026-91403 Java SE/JSSE eMudhra CA

We have been alerted to a vulnerability in the Java runtime from Oracle and OpenJDK. Bravura Security Fabric does not include or install a Java runtime, so the product itself is not directly affected. No product update is required. If you use optional Java-based connectors or the Guacamole remote desktop gateway, check the Java runtime those features use.

Issue

On October 21, 2026, Oracle and OpenJDK published CVE-2026-91403. The Java trust store in affected Java versions trusts eight compromised eMudhra intermediate CA certificates. This can let an attacker present a certificate that Java accepts as valid. The fix is an updated Java runtime, not a change to application code. No active exploitation has been reported.

Oracle and OpenJDK rated the issue 9.1 (Critical) for the Java runtime itself. This score does not apply to Bravura Security Fabric.

Affected Versions

Bravura Security Fabric 12.7, 12.8, 12.9 and 12.10 are not directly affected. We reviewed the source code and installer for these releases and confirmed that they do not include or install a Java runtime. Older versions of Bravura Security Fabric are not anticipated to be affected, but were not explicitly investigated.

Some optional features use Java. The Java-based connectors, for example RSA Authentication Manager, HP UCMDB, Oracle Hyperion EPM Shared Services, JD Edwards and the Footprints interface, run on the Java runtime you installed on the connector host. The Guacamole remote desktop gateway is a Java web application on Apache Tomcat. Docker installs include a Java 11 runtime and RPM or Debian installs use the operating system's Java. A host is exposed if it runs Java 27.0.1, 25.0.5, 21.0.13, 17.0.21, 11.0.33 or 8u511, or an earlier release of each.

Remediations

No patch from Bravura Security is required.

  • If you use any Java-based connector, update the Java runtime on each connector host to a version that includes the Oracle or OpenJDK fix for CVE-2026-91403.
  • If you use the Guacamole remote desktop gateway on Docker, rebuild the image with docker-compose build --pull to pick up a patched Java 11 runtime. For RPM or Debian installs, update the operating system's Java runtime.

If you do not use any Java-based connectors or the Guacamole gateway, you do not need to do anything.

Mitigations

If you cannot update the Java runtime yet, use one of these temporary mitigations:

  • Add OpenJDK's updated blocked.certs file to $JAVA_HOME/lib/security. On Java 8, the file is named blacklisted.certs.
  • Turn on certificate revocation checking with -Dcom.sun.net.ssl.checkRevocation=true and -Dcom.sun.security.enableCRLDP=true:
    • RSA Authentication Manager: set the connector's jvmProperties option. Do not add -D to the values. The connector adds it.
    • HP UCMDB and Oracle Hyperion EPM Shared Services: add the same jvmProperties value by editing the connector address line.
    • Guacamole gateway: add the options to CATALINA_OPTS in the Dockerfile.
    • JD Edwards and the Footprints interface: this option is not supported. Use the blocked.certs mitigation instead.

Questions

For further questions about this advisory, please reach out to support@bravurasecurity.com.

Acknowledgments

We are committed to ensuring the security of our users. Bravura Security thanks the community and researchers who contribute to the security of our software.

References