Summary

CVE-2026-91403 and CVE-2026-114820 • CVSS v3.1 9.1 (Critical) Oracle CVE Numbering Authority (CNA).

Impact: A Java runtime vulnerable to CVE-2026-91403 and CVE-2026-114820 may continue to trust certificate chains associated with the compromised eMudhra intermediate CA private keys. This could allow an attacker possessing a compromised CA key to present fraudulently issued certificates that Java may trust, potentially undermining TLS authentication and exposing the confidentiality and integrity of communications. CVE-2026-91403 addresses the compromised intermediate certificates, while CVE-2026-114820 provides the stronger remediation by removing the associated eMudhra and AAA Certificate Services root certificates from the Java trust store.

Axway is aware that eMudhra intermediate CA certificates have been compromised with the need to remove these certificates from all API Management components ASAP.

Problem

API Gateway includes a default set of CA certificates both in the fed certificate store and the bundled Azul Zulu JRE. These are trusted by default in the JRE and potentially unknowingly trusted by API Gateway "Connect to URL" connections using the "trust all" certificates option.
Full remediation will consists of upgrading API Gateway to the next version 7.7.20261130 (Nov 26) or applying patches when they become available. A patch is only possible for the JRE and not the API Gateway. This article will be updated when patches are available or with any new information.

Axway has published the attached Security Notice with further details.

Remediation — what needs to be done

API Gateway Entity Certificate Store (used by HTTPS/Websockets)

For all API Gateway groups running instances use Policy Studio to remove the following certificates below (if found). These are included in the default configuration. However they could have been removed during hardening by pruning legacy or unauthorized roots certificates from the runtime certificate store.

"CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB"
"CN=emSign ECC Root CA - G3, O=eMudhra Technologies Limited, OU=emSign PKI, C=IN"
"CN=emSign Root CA - G1, O=eMudhra Technologies Limited, OU=emSign PKI, C=IN"
"CN=emSign Root CA - G2, O=eMudhra Technologies Limited, OU=emSign PKI, C=IN"

• Open the target server config in Policy Studio
• API Gateway->Environment Configuration->Certificates and Keys -> Certificates (click on CA tab)
• in search box type "emSign" and then "AAA Certificate" to find the compromised certificates above
• click to select the certificate
• click the remove box in the bottom right
• "Yes" to confirm
• repeat for all "emSign" and "AAA Certificate Services" certificates
• Redeploy the configuration.
• Repeat for all Groups/Instances

Yaml ES Configurations

If using a YAML configuration the certificates can be removed either with Policy Studio above or deleting the following files from the fed structure

/Environment Configuration/Certificate Store/CN=emSign ECC Root CA - C3, O=eMudhra In-1134799953-cert.pem
/Environment Configuration/Certificate Store/CN=emSign ECC Root CA - C3, O=eMudhra In-1134799953.yaml
/Environment Configuration/Certificate Store/CN=emSign ECC Root CA - G3, O=eMudhra Te-1686814980-cert.pem
/Environment Configuration/Certificate Store/CN=emSign ECC Root CA - G3, O=eMudhra Te-1686814980.yaml
/Environment Configuration/Certificate Store/CN=emSign Root CA - C1, O=eMudhra Inc, O-1462341004-cert.pem
/Environment Configuration/Certificate Store/CN=emSign Root CA - C1, O=eMudhra Inc, O-1462341004.yaml
/Environment Configuration/Certificate Store/CN=emSign Root CA - G1, O=eMudhra Techno-1252449479-cert.pem
/Environment Configuration/Certificate Store/CN=emSign Root CA - G1, O=eMudhra Techno-1252449479.yaml
/Environment Configuration/Certificate Store/CN=emSign Root CA - G2, O=eMudhra Techno-814439976-cert.pem
/Environment Configuration/Certificate Store/CN=emSign Root CA - G2, O=eMudhra Techno-814439976.yaml
/Environment Configuration/Certificate Store/CN=AAA Certificate Services, O=Comodo CA-495673508-cert.pem
/Environment Configuration/Certificate Store/CN=AAA Certificate Services, O=Comodo CA-495673508.yaml

API Gateway Java Runtime certificates (used by JMS/LDAPS/JDBC)

• Apply the following mitigation steps
• Shell access needed to each API Gateway server installation

Block eMudhra Certificates (CVE-2026-91403)

• Find the location of Zulu JRE by running https://docs.azul.com/core/emudhra-workaround.html...

sudo sh -c 'find / \( -path /proc -o -path /sys -o -path /dev -o -path /System/Volumes -o -path /run/containerd -o -path /var/lib/docker -o -path /var/lib/containerd -o -path /var/lib/containers \) -prune -o -type f \( -name blocked.certs -o -name blacklisted.certs \) -path "*/lib/security/*" -print 2>/dev/null | while IFS= read -r f; do h=${f%/lib/security/*}; if grep -qsE "Azul|Zulu" "$h/release" "$h/../release"; then echo "Zulu:    $f"; elif ! grep -qs "^IMPLEMENTOR=" "$h/release" "$h/../release"; then echo "UNKNOWN: $f  (no vendor in release file; check by hand)"; fi; done'

• run the script from https://docs.azul.com/core/emudhra-workaround.html... against each found Azul Zulu JRE passing the path to the detected java executable as below but replace /opt/Axway-7.7 with your API Gateway root directory :-

zulu-emudhra-workaround.sh  /opt/Axway-7.7/apigateway/Linux.x86_64/jre/bin/java

Remove eMudhra Certificates (CVE-2026-114820)

Also it is recommended to remove the compromised certificates completely. This is done by following the steps from https://ops.java/emudhra The API Gateway should be 7.7.20230831 (Aug 23) or after, this was the first to bundle Java 11 (Java 8 previously).

• use the same shell access and run the following commands (again change /opt/Axway-7.7 as appropriate)

$ /opt/Axway-7.7/apigateway/Linux.x86_64/jre/bin/keytool -delete -cacerts -alias "emsignrootcag1 [jdk]"
$ /opt/Axway-7.7/apigateway/Linux.x86_64/jre/bin/keytool -delete -cacerts -alias "emsignrootcag2 [jdk]"
$ /opt/Axway-7.7/apigateway/Linux.x86_64/jre/bin/keytool -delete -cacerts -alias "emsigneccrootcag3 [jdk]"
$ /opt/Axway-7.7/apigateway/Linux.x86_64/jre/bin/keytool -delete -cacerts -alias "comodoaaaca [jdk]"

• restart instances

Testing the Changes

Verify your outbound endpoints in a test environment before making changes to production. Only connections that depended on a certificate issued by emSign could be affected. Browsers and Operating Systems have already removed these certificates from their systems and trust checks.

References

https://emudhra.we-have-a-problem.com/

https://ops.java/emudhra

https://docs.azul.com/core/emudhra-workaround.html

https://nvd.nist.gov/vuln/detail/cve-2026-91403

https://nvd.nist.gov/vuln/detail/cve-2026-114820

https://www.oracle.com/security-alerts/alert-cve-2...