Microsoft ships out-of-band Windows updates removing seven eMudhra-linked roots after eight weakly generated CA intermediate keys found recoverable

Linha do tempo

1. gbhackers.com ↗ · pub. 28/10/2026 09:29 · coletado 28/10 10:00

   Microsoft issues emergency Windows update distrusting seven eMudhra CA certificates after weak key generation exposed intermediate CA keys

   ler a análise desta fonte ocultar

   Microsoft released an out-of-band Windows update on October 26, 2026 that removes seven certificates tied to eMudhra certificate authority hierarchies from the Windows trust list. The same removals reached Microsoft Edge on October 27, according to the Microsoft Security Response Center (MSRC). The action covers eight compromised intermediate CA private keys, six used for TLS and two for code signing. Microsoft says the problem originated in eMudhra's certificate hierarchy, not in Microsoft systems. The MSRC statement does not establish that attackers have used the keys against customers.

   Technical Details

   • eMudhra's security incident report attributes the exposure of the affected keys to weak key generation. An attacker could recover the keys and issue certificates or sign content without the CA's approval.
   • The six TLS keys could support fake website certificates, enabling impersonation of trusted services and potential interception of communications. The two code-signing keys could make malicious software appear to come from a trusted publisher.
   • On October 20, Microsoft first updated the Windows Disallowed Certificate Trust List to block the affected CAs. It also pushed a CRLSet update for Edge and WebView2 that blocks the affected TLS certificates through automatic component updates, with no new browser version needed.
   • The later trust-list changes go further. They remove six eMudhra G3 roots and an AAA Certificate Services cross-sign, so the seven removed certificates are no longer trusted by default. This broader distrust differs from revoking the eight compromised intermediates.
   • The impact extends beyond browsers. Oracle has described separate steps to distrust the affected eMudhra intermediates in Java.

   Remediation

   • Allow Windows certificate trust updates and Edge component updates to reach endpoints. For disconnected systems, distribute updated trust lists through an internal file or web server and verify their status, following Microsoft's guidance.
   • Identify certificates that chain to the seven removed certificates and arrange replacements or another trusted chain.
   • Review disconnected Azure virtual machines and Virtual Machine Scale Sets. Updated images are available through Azure Marketplace.
   • Be cautious about restoring trust locally. Software that skips revocation checks or the Microsoft disallowed-certificate list could still accept certificates linked to the compromised intermediates. Assess those checks before making compatibility exceptions.
   • Microsoft continues to investigate and is evaluating the remaining eMudhra roots separately.
2. bleepingcomputer.com ↗ · pub. 27/10/2026 15:20 · coletado 27/10 17:00

   Microsoft ships OOB Windows updates removing eMudhra roots after eight CA intermediate keys found trivially recoverable

   ler a análise desta fonte ocultar

   Microsoft released out-of-band Windows updates on October 26 that remove trust in seven certificates tied to the compromised eMudhra certificate authority hierarchies. The updates target systems that do not receive automatic Certificate Trust List (CTL) updates, such as air-gapped devices, devices that cannot reach Microsoft's certificate-update service, and devices with automatic CTL updates disabled. The trigger was the discovery of eight eMudhra intermediate CA private keys so weak that they could be recovered almost instantly, which could have let attackers forge certificates for legitimate websites and intercept encrypted traffic. The article does not report exploitation in the wild. Microsoft is still investigating the remaining eMudhra roots and may make further trust changes.

   Technical Details

   • All eight keys were generated in April 2025 and had values smaller than 256, so they could be recovered by testing only 256 candidate numbers.
   • The affected intermediates comprise six used for TLS and two for code signing.
   • eMudhra revoked the eight intermediates, and Mozilla, Google, Apple and other vendors began revoking them as well.
   • Microsoft had already updated the Windows Disallowed Certificate Trust List for the eight intermediates. It also shipped a CRLSet update for Microsoft Edge and WebView2 that blocks the affected TLS certificates without a browser update.
   • The October 26 update removes seven certificates from the Windows trust list: six eMudhra G3 roots and an AAA Certificate Services cross-sign. The same seven will be removed from the Edge trust list on October 27.
   • Microsoft notes that removing a root is a separate and broader trust decision than revoking the known compromised intermediates.
   • Updates: KB5134133 (Windows 11 24H2, 25H2, 26H2) and KB5134125 (Windows 10 21H2, 22H2).

   Remediation

   • Install KB5134133 or KB5134125 on disconnected Windows systems and on systems where automatic CTL updates are disabled or blocked.
   • Identify certificates that chain to the removed roots, since they may need to be replaced.
   • Organizations with a specific compatibility need may trust a certificate locally, subject to their own security assessment and policies.
3. theregister.com ↗ · pub. 27/10/2026 09:30 · coletado 27/10 11:00 primeiro registro

   Microsoft ships out-of-band Windows update removing seven eMudhra-linked roots after CA private key compromise

   ler a análise desta fonte ocultar

   Microsoft released a non-security out-of-band update for Windows 11, Windows 10 and Windows Server 2025 on October 26. It refreshes the certificate trust list (CTL) on devices that cannot reach Microsoft's certificate-update service or have automatic CTL updates disabled. The release follows the compromise earlier this month of the private keys of Indian certification authority eMudhra. According to Microsoft, those keys could be used to create certificates or sign content that appeared to come from a trusted CA. Most devices will not need the package, because CTL updates normally arrive through the update service.

   Technical Details

   • The update removes seven certificates from the Windows trust list: six eMudhra G3 roots and an AAA Certificate Services cross-sign.
   • Microsoft had already updated the Windows Disallowed Certificate Trust List to block the affected certificates. A separate CRLSet release covered Edge and WebView2.
   • The package includes everything in the October 13 update, so it carries that update's known issues. These include VPN problems, a change that could break on-premises Exchange Server, and oddities with Smart App Control, audio, and Remote Desktop connections for non-admin users. None are fixed in this patch.

   Remediation

   • Devices that are disconnected from Microsoft's CTL update service, or that have automatic CTL updates disabled, should consider installing the out-of-band update. Weigh the October 13 known issues first.
   • Devices that receive CTL updates automatically do not need this package.