Overview

A vulnerability was identified regarding digital certificates issued by the eMudhra Certificate Authority, detailed in CVE-2026-111943 and CVE-2026-91403. The following intermediate certificate authorities are affected:

• EM DV TLS CA – G3B

• EM DV TLS CA – G3C

• EM OV TLS CA – G3B

• EM OV TLS CA – G3C

• EM EV TLS CA – G3B

• EM EV TLS CA – G3C

• EM OV CS CA – G3B

• EM OV CS CA – G3C

Impact and Status by Neo4j Product

Self-Managed Enterprise Edition Databases

Neo4j self-managed database products are not directly vulnerable. However, self-managed customers are strongly advised to update their host operating systems and Java Virtual Machines (JVMs) to the latest patch releases to incorporate upstream root store fixes.

Containers and Docker Images

All published container and Docker images shipping base OS packages or bundled Java JDKs have been updated with vulnerable eMudhra certificates removed.

Neo4j Aura

All Aura features are updated (release 2026.10.1) to remove vulnerable eMudhra certificates across all production environments. 

Neo4j Desktop

For information on how to remove affected CAs for Neo4j Desktop, please refer to the knowledge base article Fixing EMUDHRA CA in Neo4j Desktop (CVE-2026-111943, CVE-2026-91403)