CVE-2026-91403: Java Security Update for Protectimus On-Premise MFA Platform

We recommend that customers using Protectimus On-Premise MFA Platform update their Java runtime to address the recently identified security vulnerability CVE-2026-91403, related to compromised eMudhra/emSign intermediate CA certificates.

Follow the instructions below to update Java or apply a temporary workaround if an immediate update is not possible.

Updating Java to address CVE-2026-91403

Update Java to a build that includes the fix for CVE-2026-91403 (the compromised eMudhra/emSign intermediate CA certificates). Java from any vendor can be used (Oracle JDK, Eclipse Temurin, Amazon Corretto, etc.), as long as the build was released after October 21, 2026 and includes the fix. Check the vendor’s release notes for CVE-2026-91403 or eMudhra.

Installing Oracle JRE 8 on Windows

1. Open Download the Latest Java LTS Free
2. Select the Java 21 tab, then the JRE 8 tab, then Windows.
3. Download the x64 Installer (.exe) or the x64 MSI Installer (.msi).
4. Run the installer and complete the installation.
5. Make sure the
   
   JAVA_HOME and
   
   PATH environment variables point to the newly installed Java (not to the old version).


6. Open a new Command Prompt and run
   
   java -version
   Verify that the version matches the build you downloaded.


7. Restart Protectimus Platform so it starts using the updated Java.

If Java cannot be updated right now

The vulnerability can be mitigated manually, without updating Java.

Follow the instructions here: Distrusting eMudhra Intermediate Certificates in Oracle JDK.

Note that this is a temporary workaround. Updating Java remains the recommended solution.