CostPerform Security Patch Information

eMudhra Compromised Certificate Authorities Vulnerability (CVE-2026-91403)
Document revision
  • Created: October 23, 2026
What is the vulnerability?

Wednesday, October 21 2026, OpenJDK and Oracle published an out-of-band security advisory for a critical vulnerability (CVSS 9.1) in the TLS/SSL component (JSSE) of Java.

Java trusted eight intermediate certificate authority (CA) certificates issued by the eMudhra certificate authority that were created with weak private keys. These keys can be recovered from the public certificates. An attacker who is able to intercept network traffic (man-in-the-middle) could use them to issue certificates for arbitrary host names, which Java would then accept as valid. This undermines the protection of encrypted (HTTPS/TLS) connections and of signed code.

Read this document carefully to see if you're impacted, and if yes, what to do.

Is CostPerform impacted?

Yes. CostPerform comes bundled with an Eclipse Temurin Java runtime (JRE/JDK). All Java release families (Java 8 up to and including Java 27) are affected, including the Temurin runtimes shipped with CostPerform. The vulnerable certificates are trusted by default, so no configuration change is needed for CostPerform to be affected.

What does this mean for you?

The risk of this vulnerability being exploited in CostPerform is low. To misuse it, an attacker would first have to secretly place themselves between CostPerform and the servers it talks to, which is only our own website and servers you have configured yourself, such as your login provider. That is very difficult to do, especially inside our secured AWS environment, and there are no known cases of this vulnerability being exploited. Even so, we take it seriously and are updating CostPerform to remove the risk completely.

How do I mitigate this?

The compromised certificates must be blocked in the Java runtime used by CostPerform. Java maintains a list of distrusted certificates in a file called blocked.certs. By adding the fingerprints (hashes) of the compromised certificates to this file, Java will reject any connection or signature that relies on them.

See: Block the compromised certificates.

In the following descriptions, %COSTPERFORM_HOME% points to the directory where CostPerform is installed.

Block the compromised certificates

This procedure is valid for both servers and clients.

Read this whole description before attempting the modification!

Always create backups of deleted or modified files. Do NOT backup files in the same directory. This might cause errors. Keep backups OUTSIDE the installation directory!

  1. Stop the server, service or client
  2. Open Windows Explorer
  3. Navigate to %COSTPERFORM_HOME%\jsdk\lib\security
  4. Open the file blocked.certs in a text editor such as Notepad
  5. Leave the first line (Algorithm=SHA-256) and all existing lines untouched
  6. Copy and paste the hashes listed below at the end of the file, each on its own line
  7. Save the file
  8. Start the server, service or client

Alernatively, you can download the official version of blocked.certs from the official OpenJDK website here: https://openjdk.org/groups/vulnerability/advisories/2026-10-21 (Under section "Advice to users").

Hashes to add to blocked.certs
# eMudhra compromised intermediate CAs (2026-10-20 / CVE-2026-91403)
# EM DV TLS CA - G3B (issued by emSign Root TLS CA - G3)
42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493
# EM DV TLS CA - G3B (issued by AAA Certificate Services)
45A883F349AEDFD5F3A649B5498FFB121712BA8B448F3F2A91DBC5A766FCDDBE
# EM DV TLS CA - G3C (issued by emSign Root TLS CA - G3)
0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19
# EM DV TLS CA - G3C (issued by AAA Certificate Services)
62B7F9868263F72F6911FC78CEAF72C1979158B7368BF648683BB2AA39B02E72
# EM OV TLS CA - G3B (issued by emSign Root TLS CA - G3)
98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B
# EM OV TLS CA - G3B (issued by AAA Certificate Services)
5F1DED4DD590AF74631290CF073B122A2AAC6A1FA479778A0BD43579BD832699
# EM OV TLS CA - G3C (issued by emSign Root TLS CA - G3)
CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F
# EM OV TLS CA - G3C (issued by AAA Certificate Services)
7485B51C0ED192878FA1D2F948FB529AE1842CC5086C4B67F7BE5B2039DE9489
# EM EV TLS CA - G3B (issued by emSign Root TLS CA - G3)
E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838
# EM EV TLS CA - G3B (issued by AAA Certificate Services)
579480AEA166290BD3C643589E795FC0D0E54E86505D180F1DFF99EFD3199512
# EM EV TLS CA - G3C (issued by emSign Root TLS CA - G3)
432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3
# EM EV TLS CA - G3C (issued by AAA Certificate Services)
FD9D5C2DBBD4995AB69B8D50C439D9527B00529199C2FD01B2174EB58F07021F
# EM OV CS CA - G3B (issued by emSign Root CS CA - G3)
9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4
# EM OV CS CA - G3B (issued by AAA Certificate Services)
A496E23AC0CAB8155FC9B117B97EAE368EFCBB9041AEC8804D5A308D2D01C2D8
# EM OV CS CA - G3C (issued by emSign Root CS CA - G3)
4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1
# EM OV CS CA - G3C (issued by AAA Certificate Services)
84112972B8E59D14560AE7E7119654474AAD119990CF3722BFC1E3B91615E1FD
# Alternate DER and ECDSA malleable signature encodings
37E866582D43C35D7C17D47794B974F291B3047B868DC123382477F7A08AEFA8
A4B72DBD37256324B557B9176F8CBA4310DDFFBCC4609977E2463F3504A716C8
33C1BCDC6DA52DF950B3B14121127DA1955F7F31F828497A7608986EB2DDCC09
A104B1314DF8E02F7DE27DDC287D0961D6E6824AD4DAFC3D11064F24C1B653D5
EF34030C01B13BF42B534072DCC3C75B13C009DC9241119ADA39E2C15E2AFD2E
169A0523C5E071AA4E298286DBD4EE0E40C8C06ABB6B0C077D132F001FA19240
5D8FC3ECDDB4DDB243AEE5C306BCFDE670ADF2D66B193DD3AA2D6B2FB91869BE
AB7292F82267333031F512379FDBADA949DFA49D3C046CC8FA7F34117C342986
10E7E5BFDB55CFB78D0C21366654046182087A1960C079682513795665AA0C6B
21182E577E5106B669322ABE6086FFF6B101E8C83FD2D01DC32D854961AAC832
3B88E4B77FC53C45CA216700E39FC0EA7621A0A40FCB268215082E35D2BD5829
3C5456D4219BA2372273867FAC9A07104600391E96C7FDCDE3B4420C0F1F69BF
4DED6F955374E40B8558A611A9719B2AB69AA6852AC50966EDC4B07DE4D4277C
50E71B08B9AC407B93D50EE90100CB6B6B41C956DC7AA86C5BAA38AE713CFD6A
558EC6CA13DA9B800FEDC9ACC3C18CA98BB19768F1309B60B5BB89793B3481CB
59CC5FD35A737B84682EDA26AD23F5ADE8AA847D5BEB3B38AB6CD62347925A66
75D8853BE99C87678E6C7BF9F684B31454D81DEB1C7F37B9FBC026A268337536
7BA62FEC54E9D040556FCA70A6A88F03761C178FA1F7CB8390A73076849F55A2
8F580C6E34CEE7EE57B93BA9C0AC5FAEDD7BF3085F5EE9C6C0175A2555B111D0
8FED925362F62FFF90DD835BE6ADC32B02DEC8DF5E82D83E512F1C977D066E82
912A48745BFF2F14D1798B27858613DE1C0EB03C2BDE630AFD0DDD5251E1EBE1
9E7617035CFF537C837E078A7CDC7FD9EB77BCE7DDF3DC6DBD5C50AAFC1F1FA7
A0ED2032C5249EE1A653F1F88005D9E779E385DF533B5C521137CEE5176CD7FC
A4328E058C867AF9CA8D468C388B72C250CE84BDB6BAF7F8C47C9A0B1CB35EEC
A61FE79B019062DD3C6420BC20EAF64702CC1063C546A084DD0A0BCB915A14A9
B7121039CAF13E03E52507F42DB56FA802FF119DA7591ABA8A2E842133DB7C9C
B75104427B6A5BE55033AF50DC0FE3102181BE130E761D487A4E8178C93317DD
C5F1531C6331659C75A6411A088A65DAD7518FD91F57B64537A651B6DCD76AE0
C65CBC98295549BA940494A6214B9706E7115E64F3FE269412C5B48AEACB2222
C93F7B1EEF27CFD0F227DFE3F057D63833533890B7230B1821A424BD40848E33
CD740652E552D93EE64D7C9D1CC25228E466895889CEE25A11C962AB09906978
D8A50FA0068E9558E6C3BEE18CDB03B7EECBC3C56C1B2336B98AEE11644994B8
What's next?

We will incorporate a patched Java runtime into our next release.

More information

If you require more information please contact our Support Team at support@costperform.com.

Relevant Links
CVE-2026-91403 information
https://nvd.nist.gov/vuln/detail/CVE-2026-91403
OpenJDK Vulnerability Advisory
https://openjdk.org/groups/vulnerability/advisories/2026-10-21
Guillaume Laforge home
https://glaforge.dev/posts/2026/10/21/the-emudhra-ca-compromise-why-your-jvm-is-vulnerable-and-how-to-fix-it