The Vulnerability Impact On ESET Protect Server

Dear Customer, 

Urgent Security Notice: We are issuing an advisory regarding a newly disclosed, critical zero-interaction vulnerability affecting the core Java Secure Socket Extension (JSSE) module (CVE-2026-91403, CVSS 9.1).

While ESET’s proprietary security engine and application binaries remain fully secure, the ESET PROTECT Web Console relies directly on Apache Tomcat and a Java Runtime Environment (JRE / OpenJDK) to function. If your hosting server utilises an unpatched version of Java, your administration interface may be exposed to remote data manipulation risk.

Please note that Apache Tomcat itself is unaffected; the vulnerability resides strictly within the underlying Java runtime wrapper.

What You Need to Do Immediately

To ensure your centralised endpoint management console remains fully secured, please execute the following remediation steps on all servers hosting the ESET PROTECT Web Console:

Step 1: Review Internet Exposure (High Priority)
Inspect whether your ESET PROTECT Web Console server is directly open to the public internet. If it is accessible from outside your corporate network, we highly recommend closing public access immediately or restricting it behind a secure VPN/firewall to prevent potential exploit attempts.
Step 2: Identify Your Active Java Runtime
Determine the vendor and exact version of the Java environment running on your server (e.g., Oracle Java SE, Amazon Corretto, Eclipse Temurin, or OpenJDK).
Step 3: Apply the October 2026 Emergency Security Update
Download and apply the latest security patch released this week from your respective Java vendor to cover versions 8, 11, 17, 21, or 25.
Step 4: Verify Configuration & Restart Tomcat
Ensure that your Apache Tomcat instance is pointed correctly to the newly updated, secure Java directory path, then restart the Tomcat service to apply changes.

Eliminate Future Maintenance with ESET PROTECT Cloud

If you want to avoid the ongoing workload of managing underlying server infrastructure, patching web servers (Tomcat), and monitoring Java runtime vulnerabilities, we highly recommend migrating to ESET PROTECT Cloud.

By transitioning to our cloud-managed platform:

  • Zero Server Maintenance: ESET fully manages, hosts, and secures the console backend.
  • Automatic Patching: All security updates, JRE patches, and system upgrades are handled seamlessly by ESET without any downtime or manual effort on your part.
  • Enhanced Posture: Maintain world-class endpoint management while freeing up your internal IT resources.

If you have any questions, require assistance with the Java updates, or would like to explore migrating to ESET PROTECT Cloud, please reply directly to this email or contact our team.

Best regards,
Yours faithfully,
Version 2 Limited