Microsoft Releases Emergency Windows Updates to Revoke Trust in Compromised eMudhra Certificates

Microsoft has released an emergency Windows update to remove trust in certificates associated with compromised eMudhra certificate authority keys.

The out-of-band update, issued on October 26, 2026, eliminates seven certificates from the Windows trust list. Following this, the same removals were applied to Microsoft Edge on October 27, as stated by the Microsoft Security Response Center (MSRC).

This update addresses issues related to eight intermediate certificate authority private keys, six of which are used for TLS (Transport Layer Security) and two for code signing.

Attackers could potentially recover these keys and create certificates or sign content that appears trustworthy. Microsoft has clarified that the issue originated within eMudhra’s certificate hierarchy and not from a breach of Microsoft systems.

Compromised eMudhra Certificates

Certificate authorities help browsers and operating systems verify that websites and software publishers are legitimate. Control of an intermediate authority’s private key could let an attacker issue certificates without the authority’s approval. eMudhra security incident report detailed how weak key generation exposed the affected keys.

The six TLS keys could support fake website certificates, allowing attackers to pose as trusted services and potentially intercept communications. The two code-signing keys could make harmful software appear to come from a trusted publisher. However, the MSRC statement does not establish that attackers used these keys against customers.

Microsoft first updated the Windows Disallowed Certificate Trust List on October 20 to block the affected certificate authorities. It also deployed a separate CRLSet update for Edge and WebView2, blocking affected TLS certificates through automatic component updates without requiring a new browser version.

The later trust-list changes go further. They remove six eMudhra G3 roots and an AAA Certificate Services cross-sign. This broader distrust decision differs from revoking the eight compromised intermediate authorities. Once delivered, the changes mean the seven removed certificates are no longer trusted by default.

The incident also reaches beyond browsers. Oracle Java security alert coverage describes separate steps to distrust affected eMudhra intermediates, highlighting why application-level checks also matter.

Organizations should allow Windows certificate trust updates and Edge component updates to reach endpoints. For disconnected systems, Microsoft’s certificate trust-list guidance explains how administrators can distribute updated lists through an internal file or web server and verify their status.

Teams should identify certificates that chain to the seven removed certificates and arrange replacements or another trusted chain. Microsoft also advises reviewing disconnected Azure virtual machines and Virtual Machine Scale Sets, with updated images available through Azure Marketplace.

Restoring trust locally deserves particular caution. Software that skips revocation checks or Microsoft’s disallowed-certificate list could still accept certificates linked to compromised intermediates. Administrators should assess those checks before making compatibility exceptions. Microsoft continues investigating and is evaluating remaining eMudhra roots separately as customers move away from affected hierarchies.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.