ELSA-2026-88455

ELSA-2026-88455 - ca-certificates security update

Type:	SECURITY
Impact:	CRITICAL
Release Date:	2026-10-23

Description

[2026.2.92_v9.0.319-100.3]
- Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch

[2026.2.92_v9.0.319-100.2]
- Removing: emSign Root CS CA - G3 from Microsoft Code Signing certificates

[2026.2.92_v9.0.319-100.1]
- Removing: AAA Certificate Services root CA
- Removing: emSign ECC Root CA - G3 from Microsoft Code Signing certificates

[2026.2.92_v9.0.319-100.0]
- Update to CKBI 2.92_v9.0.319 from NSS 3.131.1
Removing:
- emSign Root CA - C1

Adding:
- Actalis Code Signing ECC Root CA 2025
- Actalis Code Signing RSA Root CA 2025
- emSign Root CS CA - G2
- emSign Root CS CA - G3
- IdenTrust Commercial Root Code Signing RSA CA 2
- e-Szigno CodeSigning Root CA 2024

[2026.2.90_v9.0.316-100.0]
- Update to CKBI 2.90_v9.0.316 from NSS 3.126
Removing:
- ePKI Root Certification Authority

Adding:
- SECOM TLS RSA Root CA 2024
- SECOM TLS ECC Root CA 2024
- SECOM SMIME RSA Root CA 2024
- Telia EC Email Root CA v3
- Telia EC TLS Root CA v3
- Telia RSA Email Root CA v3
- Telia RSA TLS Root CA v3
- Chunghwa Telecom Co., Ltd.

[2026.2.88_v9.0.316-100.0]
- Update to CKBI 2.88_v9.0.316 from NSS 3.125
- Removing:
- # Certificate 'XRamp Global CA Root'
- # Certificate 'certSIGN ROOT CA'
- # Certificate 'Explicitly Distrust DigiNotar Root CA'
- # Certificate 'CommScope Public Trust ECC Root-01'
- # Certificate 'CommScope Public Trust ECC Root-02'
- # Certificate 'CommScope Public Trust RSA Root-01'
- # Certificate 'CommScope Public Trust RSA Root-02'
- # Certificate 'FIRMAPROFESIONAL CA ROOT-A WEB'
- # Certificate 'SecureSign Root CA12'
- Adding:
- # Certificate 'OISTE Client Root ECC G1'
- # Certificate 'OISTE Client Root RSA G1'
- # Certificate 'OISTE Server Root ECC G1'
- # Certificate 'OISTE Server Root RSA G1'
- # Certificate 'e-Szigno TLS Root CA 2023'
- # Certificate 'SecureSign Root CA16'
- # Certificate 'certSIGN'
- # Certificate 'XRamp Global Certification Authority'

Related CVEs

CVE-2026-114406

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	ca-certificates-2026.2.92_v9.0.319-100.3.el10_2.src.rpm	a16391543d2898462b99b20af8a793ef3417483d19a497a8278337f97715ecb4	-	ol10_aarch64_baseos_latest
	ca-certificates-2026.2.92_v9.0.319-100.3.el10_2.src.rpm	a16391543d2898462b99b20af8a793ef3417483d19a497a8278337f97715ecb4	-	ol10_aarch64_u2_baseos_patch
	ca-certificates-2026.2.92_v9.0.319-100.3.el10_2.noarch.rpm	9c74e445906aa456d4e6893f71634edb06eac9342379bb1b04184add2584980b	-	ol10_aarch64_baseos_latest
	ca-certificates-2026.2.92_v9.0.319-100.3.el10_2.noarch.rpm	9c74e445906aa456d4e6893f71634edb06eac9342379bb1b04184add2584980b	-	ol10_aarch64_u2_baseos_patch
Oracle Linux 10 (x86_64)	ca-certificates-2026.2.92_v9.0.319-100.3.el10_2.src.rpm	a16391543d2898462b99b20af8a793ef3417483d19a497a8278337f97715ecb4	-	ol10_x86_64_baseos_latest
	ca-certificates-2026.2.92_v9.0.319-100.3.el10_2.src.rpm	a16391543d2898462b99b20af8a793ef3417483d19a497a8278337f97715ecb4	-	ol10_x86_64_u2_baseos_patch
	ca-certificates-2026.2.92_v9.0.319-100.3.el10_2.noarch.rpm	9c74e445906aa456d4e6893f71634edb06eac9342379bb1b04184add2584980b	-	ol10_x86_64_baseos_latest
	ca-certificates-2026.2.92_v9.0.319-100.3.el10_2.noarch.rpm	9c74e445906aa456d4e6893f71634edb06eac9342379bb1b04184add2584980b	-	ol10_x86_64_u2_baseos_patch

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team