Microsoft issues Windows updates to remove trust in eMudhra certificates
Summary
Microsoft released out-of-band Windows updates to remove trust in certificates tied to eight weak eMudhra intermediate keys. The keys could have enabled forged certificates; admins should update affected systems and check certificates relying on removed roots.
Key points
- Eight eMudhra intermediate CA private keys generated in April 2025 were weak enough to be recovered by testing 256 possible values.
- The keys could have enabled attackers to forge certificates for legitimate websites and intercept encrypted communications.
- KB5134133 covers Windows 11 versions 24H2, 25H2, and 26H2; KB5134125 covers Windows 10 versions 21H2 and 22H2.
- The October 26 out-of-band updates remove seven certificates from the Windows trust list, including six eMudhra G3 roots and an AAA Certificate Services cross-sign.
- The updates are intended particularly for systems that cannot receive automatic certificate trust updates.
- Microsoft advises admins to check certificates that depend on the removed roots, as some may need replacement; it is investigating remaining eMudhra roots.
Article Details
- Vulnerability Types
- Weak intermediate certificate authority private keys
- Affected Versions
- Windows 11 24H2
- Windows 11 25H2
- Windows 11 26H2
- Windows 10 21H2
- Windows 10 22H2
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
Vendors
AppleAfter the disclosure, eMudhra revoked the eight compromised intermediate certificates, and Mozilla, Google, Apple, and other software vendors also began revoking them.eMudhraMicrosoft releases Windows OOB updates to distrust eMudhra certificatesGoogleAfter the disclosure, eMudhra revoked the eight compromised intermediate certificates, and Mozilla, Google, Apple, and other software vendors also began revoking them.MicrosoftMicrosoft releases Windows OOB updates to distrust eMudhra certificatesMozillaAfter the disclosure, eMudhra revoked the eight compromised intermediate certificates, and Mozilla, Google, Apple, and other software vendors also began revoking them.
Products
Microsoft EdgeThe company also released a CRLSet update for Microsoft Edge and WebView2 to block affected TLS certificates, which enabled the block without requiring a browser update.WebView2The company also released a CRLSet update for Microsoft Edge and WebView2 to block affected TLS certificates, which enabled the block without requiring a browser update.Windows 10The KB5134133 update for Windows 11 versions 24H2, 25H2, and 26H2 and the KB5134125 update for Windows 10 versions 21H2 and 22H2 were released on October 26.Windows 11The KB5134133 update for Windows 11 versions 24H2, 25H2, and 26H2 and the KB5134125 update for Windows 10 versions 21H2 and 22H2 were released on October 26.