eMudhra intermediate CA keys can be brute-forced, Cisco says
Original title: Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
A researcher showed eight intermediate private keys from an April 2025 ceremony can be recovered in seconds.
Between October 17 and October 20, 2026, a compromise of certificate authorities managed by eMudhra was uncovered. A researcher demonstrated that private keys for eight eMudhra intermediate certificates were broken by an error in their April 2025 key generation ceremony, allowing anyone to brute-force the keys within seconds. Cisco published an informational advisory calling for emergency distrust of eMudhra root and intermediate authorities and said unlisted products are not affected.
Unconfirmed: The snippet does not say the keys were used in attacks, and the affected-product list is cut off.
- Eight eMudhra intermediate certificates are named as having broken private keys.
- The key generation ceremony error dates to April 2025.
- Cisco points to eMudhra’s compromise write-up and a Cisco Talos blog post.
- The feed snippet does not name the affected Cisco products.
Impact: Anyone can recover eight eMudhra intermediate CA private keys
| Product | Affected |
|---|---|
| eMudhra root and intermediate certificate authorities | eight intermediate certificates from the April 2025 key generation ceremony |
- 1.Distrust eMudhra root and intermediate certificate authorities.
- 2.Check Cisco’s advisory for whether a product is listed as affected.
- Organizations
- Cisco Talos
From the original article
Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private keys for eight eMudhra intermediate certificates were fundamentally broken due to an unprecedented error in their Key Generation Ceremony (KGC) in April 2025.
sec.cloudapps.cisco.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.