CVE-2026-91403 concerns eight compromised intermediate CA certificates.

If you use a standalone OpenJDK Java runtime, we recommend that you update it as soon as possible, since it likely contains the compromised certificates. If that is not possible, take immediate action by implementing one of these steps:

• Manually block the impacted certificates. First, download the blocked.certs file for your operating system. There is a version for Windows and a version for other operating systems. Find your local $JDK_HOME/lib/security/blocked.certs file. If you have already added entries to this file, create a backup and re-add your entries to the new file. Otherwise, move or replace the blocked.certs file with the downloaded version. For JDK 8, rename blocked.certs to blacklisted.certs; the file location is the same.