Java October 2026 update and CVE-2026-91403: how to patch every JVM

Java had two security releases in two days. On 20 October 2026 Oracle's quarterly Critical Patch Update fixed 55 vulnerabilities in Java SE, 49 of them exploitable over the network without logging in. On 21 October Oracle followed with an out-of-band Security Alert for CVE-2026-91403, a flaw in Java's TLS implementation (JSSE) with a CVSS score of 9.1, and the versions it affects include the ones released the day before. Japan's IPA warned on 21 October that exploitation can crash applications or let an attacker take control of the computer. This guide shows which versions to move to, how to find every Java runtime you run, and how to check that the update is really in use.

What was fixed on 20 October

The October Critical Patch Update affects Oracle Java SE 27, 26.0.2, 25.0.4.1, 21.0.12.1, 17.0.20.1, 11.0.32.1 and 8u503, and therefore every older update of those versions. None of the 55 Java fixes is rated critical, but 49 can be exploited remotely without authentication.

Java 26 got no fix: its updates ended in September 2026. If you still run 26, move to 27 or to the long-term release 25.

CVE-2026-91403: the new versions are affected too

CVE-2026-91403 is in JSSE, the part of Java that handles TLS connections. According to Oracle it is easy to exploit, needs no account and no user interaction, and can be reached over the network through several protocols, for example through a web service that passes data to the affected APIs. A successful attack can read and change critical data (CVSS 9.1, AV:N/AC:L/PR:N/UI:N, high impact on confidentiality and integrity).

The affected versions are exactly the ones from 20 October: Java SE 8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5 and 27.0.1, as well as GraalVM for JDK 17.0.21 and 21.0.13 and GraalVM Enterprise 21.3.20. So the October update alone does not protect you from this flaw.

Oracle delivers the fix for Oracle JDK through the patch document named in the Security Alert, for customers with access to My Oracle Support. At the time of writing, Oracle's public pages do not yet list new version numbers for it, and Oracle has not said whether the flaw is already being exploited. The OpenJDK project published its own advisory on 21 October, so builds based on OpenJDK (Eclipse Temurin, Amazon Corretto, Azul Zulu, Red Hat and the Linux distributions' packages) get their fixes from those vendors. Check your vendor's security page and install the first release that names CVE-2026-91403. We will update this article when public version numbers are available.

Step 1: find every Java runtime

java -version only shows the Java on your PATH. Servers often run several: one bundled with an application, one in a container, one installed years ago in /opt.

On Linux, list every Java binary with its version:

sudo find / -xdev -type f -name java -perm -u+x 2>/dev/null | while read -r j; do echo "$j: $("$j" -version 2>&1 | head -n 1)"; done

Show which Java the running processes actually use:

for p in $(pgrep -f java); do echo "$p $(sudo readlink -f /proc/$p/exe)"; done

In Docker, check the Java version of every running container:

for c in $(docker ps --format '{{.Names}}'); do echo "$c: $(docker exec "$c" java -version 2>&1 | head -n 1)"; done

On Windows, in PowerShell:

Get-ChildItem 'C:\Program Files','C:\Program Files (x86)' -Recurse -Filter java.exe -ErrorAction SilentlyContinue | ForEach-Object { "$($_.FullName): $((& $_.FullName -version 2>&1 | Select-Object -First 1))" }

Do not forget software that brings its own Java, such as Jenkins, Elasticsearch, Keycloak, Atlassian products, Tomcat bundles, build agents and game servers.

Step 2: update

Ubuntu and Debian (OpenJDK packages):

sudo apt update && apt list --upgradable 2>/dev/null | grep -i jdk
sudo apt install --only-upgrade 'openjdk-*'

Red Hat, Rocky, AlmaLinux and Fedora:

sudo dnf upgrade 'java-*-openjdk*'

Oracle JDK: install the October release for your version from Oracle's download page, then the CVE-2026-91403 patch from My Oracle Support as soon as you can. Check the license first: from 21.0.13, Oracle JDK 21 updates are no longer under the free No-Fee Terms and Conditions, and commercial use may need a paid subscription. For other OpenJDK builds such as Temurin or Corretto, install the newest release from the vendor.

Containers: an update on the host does not change a container. Pull the updated base image, rebuild your images and redeploy them.

Step 3: restart and verify

Java loads its code at start, so a running service keeps the old version until it restarts. After a package update on Linux, this command lists Java processes that still run the replaced files:

sudo ls -l /proc/*/exe 2>/dev/null | grep -i 'java.*(deleted)'

Restart those services, run the commands from step 1 again and compare the versions with the table above.

Until the CVE-2026-91403 fix is installed

• Let only the systems that need it reach Java services over the network, especially services that accept TLS connections from the internet.
• Where possible, end TLS connections in front of the Java service, for example in a reverse proxy, so that fewer untrusted TLS connections reach JSSE. This lowers the exposure but does not replace the fix.
• Watch the logs of internet-facing Java services for unusual TLS errors and crashes, and keep backups ready.

What comes next

Oracle has moved Java to more frequent security releases. The next one, a Critical Security Patch Update, is scheduled for 17 November 2026, and the next quarterly Critical Patch Update for 19 January 2027. Put both dates in your calendar and repeat the three steps above each time.

If you are not sure which of your systems run Java, or a Java service may already have been attacked, our managed security and incident response teams can help.