Dear Customer, Urgent Security Notice: We are issuing an advisory regarding a newly disclosed, critical zero-interaction vulnerability affecting the core Java Secure Socket Extension (JSSE) module (CVE-2026-91403, CVSS 9.1). While ESET’s proprietary security engine and application binaries remain fully secure, the ESET PROTECT Web Console relies directly on Apache Tomcat and a Java Runtime Environment (JRE / OpenJDK) to function. If your hosting server utilises an unpatched version of Java, your administration interface may be exposed to remote data manipulation risk. Please note that Apache Tomcat itself is unaffected; the vulnerability resides strictly within the underlying Java runtime wrapper. What You Need to Do ImmediatelyTo ensure your centralised endpoint management console remains fully secured, please execute the following remediation steps on all servers hosting the ESET PROTECT Web Console: Step 1: Review Internet Exposure (High Priority) Inspect whether your ESET PROTECT Web Console server is directly open to the public internet. If it is accessible from outside your corporate network, we highly recommend closing public access immediately or restricting it behind a secure VPN/firewall to prevent potential exploit attempts. Step 2: Identify Your Active Java Runtime Determine the vendor and exact version of the Java environment running on your server (e.g., Oracle Java SE, Amazon Corretto, Eclipse Temurin, or OpenJDK). Step 3: Apply the October 2026 Emergency Security Update Download and apply the latest security patch released this week from your respective Java vendor to cover versions 8, 11, 17, 21, or 25. Step 4: Verify Configuration & Restart Tomcat Ensure that your Apache Tomcat instance is pointed correctly to the newly updated, secure Java directory path, then restart the Tomcat service to apply changes. Eliminate Future Maintenance with ESET PROTECT CloudIf you want to avoid the ongoing workload of managing underlying server infrastructure, patching web servers (Tomcat), and monitoring Java runtime vulnerabilities, we highly recommend migrating to ESET PROTECT Cloud. By transitioning to our cloud-managed platform: - Zero Server Maintenance: ESET fully manages, hosts, and secures the console backend.
- Automatic Patching: All security updates, JRE patches, and system upgrades are handled seamlessly by ESET without any downtime or manual effort on your part.
- Enhanced Posture: Maintain world-class endpoint management while freeing up your internal IT resources.
If you have any questions, require assistance with the Java updates, or would like to explore migrating to ESET PROTECT Cloud, please reply directly to this email or contact our team. Best regards,
Yours faithfully,
Version 2 Limited | 
日期：2026年10月16日 (星期五)
時間：中午 12:00 — 下午 3:00
地點：Luna Sea (觀塘海濱道 90 號地下 1 號舖)
活動亮點：最新 ESET 產品方案分享 ｜ 業界 Networking ｜ 精緻午餐及禮品
