Skip to content
NewA calmer, faster ZeroHour
Data breachhigh

Weak eMudhra intermediate keys can impersonate sites; vendors block them

Original title: Compromised eMudhra intermediate certificates

Cisco Talos ()4 min read3 · 2 reads
Read at blog.talosintelligence.com
Part of a story covered by 21 sourceseMudhra to exit TLS after weak intermediate keys blockedMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

Go 1.27.3 and 1.26.10 distrust eight weak intermediates as CVE-2026-111943; Talos reports no malicious use yet.

Cisco Talos says eight eMudhra intermediate certificates were created with private keys reduced to 3–8 units of entropy during an April 30, 2025 key ceremony under emSign Root TLS CA - G3. Six TLS intermediates trusted by Chrome, Mozilla, and Apple, and two Microsoft code-signing intermediates, have been blocked. eMudhra revoked the certificates and stopped issuance under its G3 root. Go treats lingering trust as CVE-2026-111943 and filters the keys in 1.27.3 and 1.26.10.

Unconfirmed: Talos says it has not seen malicious use; exposure in non-browser trust stores is still being assessed.

Key facts
  • A wrap/unwrap flaw produced weak P-384 keys used for eight of 24 subordinate CAs.
  • Entropy fell from 384 bits to 3–8, making private-key recovery trivial.
  • Six certificates are TLS intermediates and two are code-signing intermediates.
  • Talos reported no malicious incidents as of October 21, 2026, 14:00 UTC.
Security assessment · AI, from the articleNo known exploitation

Impact: Fraudulent TLS or code-signing certificates if clients still trust the keys

ProductAffectedFixed in
Go—1.27.3 and 1.26.10
What to do
  1. 1.Upgrade Go to 1.27.3 or 1.26.10.
  2. 2.Update TLS software, VPNs, and appliances as distrust fixes ship.
  3. 3.Confirm clients no longer trust the eight revoked eMudhra intermediates.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
CVEs
CVE-2026-111943
Tags
emudhrapkicertificate-authoritytlscode-signinggolang
Vendors
eMudhraGo
Organizations
MozillaAppleMicrosoftGoogle

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-111943
On most platforms, Go uses the given system root certificates
—<1%PoC

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
sha2560164d7ceae5bb909c272af151ff44b1177ae9b47d9424b94f1d9558c30934d19G3 EM DV TLS CA - G3C (eMudhra Inc), CCADB A012294 SHA-256 0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19 serial 588b2e3c2bb8cda13e1a1209254321, issuer emSign Root T
sha25642c4accd12c4f59597925e1a08a7a90102608543809308d50ec427e118ba1493- G3 EM DV TLS CA - G3B (eMudhra BV), CCADB A012302 SHA-256 42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493 serial a4aee678f23362b4c0e460b772f214, issuer emSign Root T
sha256432ec25f0d28de9006d97bf752f17bbb2cd41f669933fcb072d9a1148d0261f3G3 EM EV TLS CA - G3C (eMudhra Inc), CCADB A012296 SHA-256 432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3 serial 8009928a64107601af05fa2f19f109, issuer emSign Root T
sha2564b2460a466f95fd40113bcdcca2ceb29b3b093921de45474da7df48874c630b1- G3 EM OV CS CA - G3C (eMudhra Inc), CCADB A012298 SHA-256 4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1 serial 544b7f922c31ae220a4a922916f6e6, issuer emSign Root C
sha25698b896625c0c230adeec3eb2cf6aad5001ecf9156a68644e82374ce5833bc25b- G3 EM OV TLS CA - G3B (eMudhra BV), CCADB A012308 SHA-256 98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B serial 6cada367fb1c100088120ea202d568, issuer emSign Root T
sha2569e39de2881273acc225a149c72ba3e0f51424963669ab633ee1dc7df5db067b4- G3 EM OV CS CA - G3B (eMudhra BV), CCADB A012306 SHA-256 9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4 serial 7818933f8f85b4619a2b35fba83d0a, issuer emSign Root C
sha256cb6e15165ac802e9b3f993f16c25d41f4e81c21ebde71ae1b012ac00bf9c7c3fG3 EM OV TLS CA - G3C (eMudhra Inc), CCADB A012300 SHA-256 CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F serial 296926c227a3a1526392b19482a504, issuer emSign Root T
sha256e7568fe6e12331f4fd7de61da4c7559d0f8eb192a218d4741a3ba75184333838rt : EM EV TLS CA - G3B (eMudhra BV), CCADB A012304 SHA-256 E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838 serial c7c41efe92d825f05eae841a4a82c1, issuer emSign Root T

From the original article

4 min read at blog.talosintelligence.com

Cisco Talos is aware of eight intermediate certificates belonging to the intermediate certificate authority, eMudhra.

Cisco Talos

blog.talosintelligence.com

Read the full article at Cisco Talos

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.