Security Advisory: eMudhra Intermediate CA Certificate Vulnerability (CVE-2026-91403) – VertiGIS Support

Products affected: VertiGIS 1Integrate, VertiGIS 1Data Gateway, 1SMS
Severity: Critical
Published: 21 October 2026

VertiGIS uses this page to provide centralized information about the critical vulnerability CVE-2026-91403, and the impact on VertiGIS product families.

Overview

A vulnerability has been identified relating to compromised eMudhra intermediate Certificate Authority (CA) certificates that are included in certain Java Runtime Environment (JRE) distributions.

This issue, tracked as CVE-2026-91403, may affect deployments of 1Integrate, 1Data Gateway, and 1SMS running on affected Java runtimes.

Oracle has released updates for supported Oracle Java versions. However, at the time of writing, security updates may not yet be available for all alternative Java distributions, including Eclipse Temurin (Adoptium).

References

For further technical information regarding this vulnerability, please refer to:

Oracle Security Alert Advisory - CVE-2026-91403
https://www.oracle.com/security-alerts/alert-cve-2026-91403.html
OpenCVE Reference - CVE-2026-91403
https://app.opencve.io/cve/CVE-2026-91403

Impact

Affected Java runtimes may continue to trust compromised eMudhra intermediate CA certificates. In some circumstances, this could increase the risk of interaction with malicious servers when connecting to external services, for example when a product accesses feature services or REST APIs.

The CVSS score of 9.1 places this flaw in the critical severity category. The EPSS score of <1% (approximately 0.00392%) indicates a very low probability of exploitation; however, the lack of authentication requirement and network reachability suggest that once discovered the flaw could still be exploited in environments exposing the affected Java services.

Recommended Action

Apply Java Patches When a Security Update Becomes Available

Customers should upgrade to the latest supported security patch for their current Java release as soon as it becomes available from their Java vendor.

Is VertiGIS releasing updates for the products affected by this vulnerability?

No. This issue affects the underlying Java runtime rather than the products themselves. Customers should apply any security updates provided by their Java vendor when they become available.

Are Mitigations Available Where Java Patches Are Not Yet Released?

VertiGIS are currently reviewing alternative mitigations for affected products and will update this page if suitable options are available.

Further Assistance

If you require assistance assessing your deployment, please contact your local support team.