Microsoft revokes trust in compromised eMudhra certificates
Original title: Microsoft Releases Emergency Windows Updates to Revoke Trust in Compromised eMudhra Certificates
An October 26 Windows update drops seven certificates after weak key generation exposed eight eMudhra intermediate keys.
Microsoft released an out-of-band Windows update on October 26, 2026, removing seven certificates tied to compromised eMudhra certificate-authority keys. MSRC says the problem is in eMudhra’s hierarchy, not a Microsoft breach: eight intermediate private keys were exposed, six for TLS and two for code signing. Edge received the same removals on October 27. Microsoft says this does not establish that attackers used the keys against customers.
Unconfirmed: MSRC has not established that attackers used the compromised keys, and Microsoft is still evaluating remaining eMudhra roots.
- Windows first blocked the authorities on the disallowed trust list on October 20.
- A CRLSet update blocks affected TLS certificates in Edge and WebView2 without a new browser version.
- The later change removes six eMudhra G3 roots and an AAA Certificate Services cross-sign.
- Oracle Java has separate steps to distrust the affected eMudhra intermediates.
Impact: Fake TLS certificates or trusted-looking signed software
| Product | Affected |
|---|---|
| Microsoft Windows | — |
| Microsoft Edge | — |
| eMudhra intermediate certificate authorities | eight intermediate keys; six TLS and two code signing |
- 1.Allow Windows certificate trust updates and Edge component updates to reach endpoints.
- 2.Replace certificates that chain to the seven removed certificates.
- 3.Review disconnected Azure VMs and scale sets against updated Marketplace images.
- ATT&CK
- T1553.002 Code Signing
- Products
- WindowsMicrosoft EdgeWebView2
- Organizations
- Microsoft Security Response Center
From the original article
2 min read at gbhackers.com
Microsoft has released an emergency Windows update to remove trust in certificates associated with compromised eMudhra certificate authority keys. The out-of-band update, issued on October 26, 2026, eliminates seven certificates from the Windows trust list. Following this, the same removals were applied to Microsoft Edge on October 27, as stated by the Microsoft Security Response […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.