Skip to content
NewA calmer, faster ZeroHour
StoryAdvisoryhigh

Microsoft drops seven eMudhra certificates after weak keys

4 sources · 4 articlesFirst reported Updated ()1
What's new

October 28: GBHackers adds that Oracle Java has separate steps to distrust the affected eMudhra intermediates.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Microsoft’s October 26 update removes seven eMudhra certificates; forged-certificate attacks remain possible, not confirmed.

Microsoft released a non-security out-of-band Windows update on October 26 that removes six eMudhra G3 roots and an AAA Certificate Services cross-sign from the Windows trust list. It targets systems that do not receive automatic certificate trust updates, including disconnected Windows systems and Azure virtual machines, across supported Windows 10, Windows 11, and Windows Server 2025. BleepingComputer reports eight eMudhra intermediate private keys generated in April 2025 were small enough to recover by testing 256 numbers; six were for TLS and two for code signing. eMudhra revoked those intermediates. Microsoft says it first disallowed the authorities on October 20, that its systems were not affected, and that attacks are potential rather than confirmed. Edge and WebView2 received a separate trust update, and the package carries unresolved October 13 issues.

Key facts
  • Packages are KB5134133 for Windows 11 24H2–26H2 and KB5134125 for Windows 10 21H2 and 22H2.
  • Eight intermediate keys were recoverable; six served TLS and two code signing.
  • Windows first placed the authorities on the disallowed trust list on October 20.
  • Edge’s trust list dropped the same seven certificates on October 27.
  • The update also includes unresolved VPN, Exchange, Smart App Control, audio, and Remote Desktop issues.
  • Oracle Java has separate steps to distrust the affected eMudhra intermediates.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Apr 1, 2025Eight eMudhra intermediate private keys were generated. · BleepingComputer
  2. Oct 13, 2026Prior Windows update issues remain in the new package. · The Register
  3. Oct 20, 2026Windows first blocked the authorities on the disallowed list. · Cyber Security News
  4. Oct 26, 2026Out-of-band update removes seven eMudhra-related certificates. · The Register
  5. Oct 27, 2026Edge trust list drops the same seven certificates. · BleepingComputer

What each outlet adds

beyond the shared facts
  • BleepingComputerNames KB packages and the 256-value key-recovery method.
  • The RegisterCarries unresolved October 13 issues and covers Server 2025.
  • Cyber Security NewsSays Microsoft systems were unaffected and Azure VMs need another path.
  • GBHackersNotes separate Oracle Java steps to distrust the intermediates.
Vendors
MicrosofteMudhra
Products
WindowsMicrosoft EdgeWebView2Windows 11Windows 10Edge
Organizations
Microsoft Security Response CentereMudhra
Countries
India

Coverage

oldest first · one row per article · UTC
  1. · 3d ago The Register · SecurityFirst report

    Microsoft ships Windows trust-list update after eMudhra key compromise

    The October 26 update removes seven eMudhra-related certificates for devices that do not get automatic CTL updates.

  2. · 3d ago BleepingComputer

    Microsoft Windows updates remove trust in weak eMudhra certificates

    October 26 updates target offline Windows systems after eight April 2025 intermediate keys proved recoverable.

  3. · 2d ago Cyber Security News

    Microsoft emergency updates block compromised eMudhra certificates

    Eight recoverable intermediate keys could forge TLS or code-signing certificates; Microsoft says its own systems were not affected.

  4. · 2d ago GBHackers

    Microsoft revokes trust in compromised eMudhra certificates

    An October 26 Windows update drops seven certificates after weak key generation exposed eight eMudhra intermediate keys.