CVE-2026-91403 Impact on Solibri

HieuVH-FPT

Hi @Solibrians
Could you please confirm whether the current version of Solibri is affected by this issue?
If it is affected, do you have any plans to upgrade the Java version or address this issue in a future Solibri release?
If so, could you please share the expected timeline for the upgrade?
Link: https://blogs.oracle.com/security/security-alert-cve-2026-91403-released

Matti

Solibri does not use the compromised eMudhra certificates. We don’t expect any impact in normal use.
Solibri ships with its own bundled Java runtime, so a system-wide Java update will not change it.

Plans for a Java upgrade

We will ship an updated Java runtime in our next release. We have planned Solibri 26.9.1 patch for late October/early November to include the Java update, as well as a few other bugs

Interim mitigation (optional)

Option A: Make Solibri use the Windows certificate store.
Solibri will then trust whatever your organization’s Windows root store trusts. Your IT team can manage the eMudhra distrust centrally there.

Close Solibri.
Open Solibri.vmoptions in the installation folder, using an editor started as administrator.
Add this line on its own line:

-Djavax.net.ssl.trustStoreType=WINDOWS-ROOT

Save the file and restart Solibri.

Option B: Remove the eMudhra certificates from Solibri’s Java trust store.
(Note keytool.exe is not shipped with latest Solibri. It comes standard Java installation)

Close Solibri.
Open an elevated PowerShell or Command Prompt.
Go to the Solibri installation folder. The default is C:\Program Files\Solibri\<version>.
List the eMudhra entries:

keytool.exe -list -keystore .\jre\lib\security\cacerts -storepass changeit | findstr /i emudhra

Delete each alias that is listed:

keytool.exe -delete -alias <alias-name> -keystore .\jre\lib\security\cacerts -storepass changeit

Run the list command again to confirm nothing is left, then start Solibri.