ELSA-2026-88459

ELSA-2026-88459 - ca-certificates security update

Type:	SECURITY
Impact:	CRITICAL
Release Date:	2026-10-23

Description

[2026.2.92_v9.0.319-90.3]
- Fix malformed patch header in remove-emsign-root-cs-ca-g3.patch

[2026.2.92_v9.0.319-90.2]
- Removing: emSign Root CS CA - G3 from Microsoft Code Signing certificates

[2026.2.92_v9.0.319-90.1]
- Removing: AAA Certificate Services root CA
- Removing: emSign ECC Root CA - G3 from Microsoft Code Signing certificates

[2026.2.92_v9.0.319-90.0]
- Update to CKBI 2.92_v9.0.319 from NSS 3.131.1
Removing:
- emSign Root CA - C1

Adding:
- Actalis Code Signing ECC Root CA 2025
- Actalis Code Signing RSA Root CA 2025
- emSign Root CS CA - G2
- emSign Root CS CA - G3
- IdenTrust Commercial Root Code Signing RSA CA 2
- e-Szigno CodeSigning Root CA 2024

[2026.2.90_v9.0.316-90.0]
- Update to CKBI 2.90_v9.0.316 from NSS 3.126
Removing:
- XRamp Global CA Root
- ePKI Root Certification Authority
- certSIGN ROOT CA
- Explicitly Distrust DigiNotar Root CA
- CommScope Public Trust ECC Root-01
- CommScope Public Trust ECC Root-02
- CommScope Public Trust RSA Root-01
- CommScope Public Trust RSA Root-02
- FIRMAPROFESIONAL CA ROOT-A WEB
- SecureSign Root CA12

Adding:
- OISTE Client Root ECC G1
- OISTE Client Root RSA G1
- OISTE Server Root ECC G1
- OISTE Server Root RSA G1
- e-Szigno TLS Root CA 2023
- SecureSign Root CA16
- SECOM TLS RSA Root CA 2024
- SECOM TLS ECC Root CA 2024
- SECOM SMIME RSA Root CA 2024
- Telia EC Email Root CA v3
- Telia EC TLS Root CA v3
- Telia RSA Email Root CA v3
- Telia RSA TLS Root CA v3
- certSIGN
- Chunghwa Telecom Co., Ltd.
- XRamp Global Certification Authority

Related CVEs

CVE-2026-114406

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	ca-certificates-2026.2.92_v9.0.319-90.3.el9_8.src.rpm	68b81da7d35d297bf1874fcc4b6d832b87d915e23c13a632ebb3a5339c5856b8	-	ol9_aarch64_baseos_latest
	ca-certificates-2026.2.92_v9.0.319-90.3.el9_8.src.rpm	68b81da7d35d297bf1874fcc4b6d832b87d915e23c13a632ebb3a5339c5856b8	-	ol9_aarch64_u8_baseos_patch
	ca-certificates-2026.2.92_v9.0.319-90.3.el9_8.noarch.rpm	c69abcbaa031fddd4819ee451738ab28dfc4aae27c3f32d42e18c5bf61ad93ce	-	ol9_aarch64_baseos_latest
	ca-certificates-2026.2.92_v9.0.319-90.3.el9_8.noarch.rpm	c69abcbaa031fddd4819ee451738ab28dfc4aae27c3f32d42e18c5bf61ad93ce	-	ol9_aarch64_u8_baseos_patch
Oracle Linux 9 (x86_64)	ca-certificates-2026.2.92_v9.0.319-90.3.el9_8.src.rpm	68b81da7d35d297bf1874fcc4b6d832b87d915e23c13a632ebb3a5339c5856b8	-	ol9_x86_64_baseos_latest
	ca-certificates-2026.2.92_v9.0.319-90.3.el9_8.src.rpm	68b81da7d35d297bf1874fcc4b6d832b87d915e23c13a632ebb3a5339c5856b8	-	ol9_x86_64_u8_baseos_patch
	ca-certificates-2026.2.92_v9.0.319-90.3.el9_8.noarch.rpm	c69abcbaa031fddd4819ee451738ab28dfc4aae27c3f32d42e18c5bf61ad93ce	-	ol9_x86_64_baseos_latest
	ca-certificates-2026.2.92_v9.0.319-90.3.el9_8.noarch.rpm	c69abcbaa031fddd4819ee451738ab28dfc4aae27c3f32d42e18c5bf61ad93ce	-	ol9_x86_64_u8_baseos_patch

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team