Azul has issued an out-of-cycle security update after the compromise of eight eMudhra intermediate Certificate Authority (CA) certificates, publicly disclosed on 20 October 2026.
The compromised certificates could potentially be used to impersonate trusted websites and services. While major browser and operating system vendors have already blocked the affected certificates, Azul said Java runtimes do not check certificate revocation by default, which could leave enterprise applications and infrastructure exposed if Java environments are not updated.
According to Azul, it released tested security updates within 24 hours of the disclosure across multiple versions of Azul Zulu and Azul Prime to block the eight compromised certificates, without requiring organisations to manually modify Java installations.
In its statement, Azul said eMudhra reported, and Mozilla and Google’s Chrome Root Program confirmed, that the affected private keys were generated defectively, allowing them to be derived from public certificates. Azul said eMudhra revoked the certificates and Apple, Google, Microsoft and Mozilla blocked them in browsers and operating systems.
Azul added that eMudhra stated only one of the eight intermediates was used in production and that none issued end-entity certificates, while Google reported finding no certificates chaining to them in Certificate Transparency logs.
Azul said unpatched JDKs may accept forged certificates signed with the compromised keys because the intermediates chain to roots trusted by many OpenJDK distributions, and because Java runtimes do not automatically receive revocation data.
The company said the mitigation is a block list file (lib/security/blocked.certs) that can be applied either through a JDK update or by manually placing a file into each installed runtime, including copies embedded in applications, container images and CI pipelines, followed by a restart.
Azul said it released updated builds of Azul Zulu for Java 27, 25, 21, 17, 11, 8, 7 and 6, and Azul Prime for Java 25, 21, 17, 11 and 8. It also published a documented workaround for environments that cannot be updated immediately.
The incident highlights an operational security challenge for enterprises that rely on Java: responding quickly to trust store and certificate ecosystem incidents across large, distributed runtime fleets, including embedded and containerised deployments.
Azul’s statement described the updates as “security-only” releases intended to reduce the risk of regressions during urgent patching.
In its FAQs, Azul recommended enterprises confirm which software still trusts the compromised certificates and apply vendor updates that block them, using temporary workarounds only where updates are not yet available.
