Trusence Every claim has a source
Last updated 27 October 2026 Search Türkçe
Security

Microsoft removes trust in eMudhra certificates after weak CA keys found

Systems that depend on the removed roots may need their certificates replaced, and disconnected machines must take the update manually.

27 October 2026 1 min read

Microsoft has pushed out-of-band Windows updates that strip trust from certificates linked to eMudhra certificate authority keys that were found to be dangerously weak. The KB5134133 update for Windows 11 (24H2, 25H2, 26H2) and KB5134125 for Windows 10 (21H2, 22H2) shipped on October 26, aimed at machines without internet access, those unable to reach Microsoft's certificate service, and systems with automatic trust-list updates turned off. The trigger was eight intermediate CA private keys generated in April 2025 that were small enough for anyone to recover by checking 256 possible values, which would have let attackers forge certificates for legitimate sites. Earlier, Microsoft had already added the eight affected intermediates to its Disallowed Certificate Trust List and shipped a CRLSet update for Edge and WebView2. The new patch goes further by removing seven certificates from the Windows trust list, including the eMudhra roots that verify certificates issued by the CA, with Edge following on October 27. Administrators are advised to install the update on disconnected systems and check which certificates depend on the removed roots, since those may need replacing.

Why it matters

Anyone relying on certificates issued under the affected eMudhra authorities now faces a loss of trust in Windows and, from October 27, in Edge. Eight intermediate keys generated in April 2025 were weak enough to be recovered by testing just 256 values, which would have let attackers forge certificates for legitimate websites and intercept encrypted traffic. Microsoft's move to remove the eMudhra roots themselves, rather than only blocking the intermediates, means the damage reaches beyond the eight keys to every certificate chained to those roots, so the change touches a wider set of sites and users than the original compromise.

Series eMudhra weak intermediate keys

  1. 27 Oct Microsoft removes trust in eMudhra certificates after weak CA keys found
  2. 21 Oct eMudhra intermediate CA keys found weak; browsers block eight certificates
  3. 20 Oct Eight eMudhra intermediate certificates blocked by browsers after weak keys found
The whole series · 3 stories →

Sources · 1

Checked against its sources before publishing · 27 October at 22:07