Microsoft removes eMudhra roots from Windows trust list

Microsoft issued out-of-band updates on October 26 that pull seven certificates linked to the compromised eMudhra CA keys out of the Windows trust list. KB5134133 applies to Windows 11 24H2, 25H2 and 26H2, and KB5134125 applies to Windows 10 21H2 and 22H2. The updates are intended for disconnected systems, devices that cannot reach Microsoft's certificate-update service, and machines with automatic Certificate Trust List updates disabled. The seven removed certificates consist of six eMudhra G3 roots plus an AAA Certificate Services cross-sign, according to Microsoft. Microsoft will take those same seven certificates out of the Edge trust list on October 27.

The action follows disclosure of eight eMudhra intermediate CA private keys that were generated in April 2025 with values smaller than 256, so an attacker could recover each by testing just 256 possible numbers. BleepingComputer reported that those keys would have let attackers mint certificates for real websites and read encrypted traffic. SitePoint separately reported that specific recovered private exponent values included 4, 56 and 115, and that the vendors were notified on October 17, 2026. Chrome deployed a CRLSet update that evening, Mozilla's OneCRL blocked the intermediates within hours, Apple rolled out its platform-level distrust on October 19, and Microsoft followed on October 20, according to SitePoint. As a result, current browser releases refuse the compromised intermediates via their revocation infrastructure.

Microsoft had earlier placed the eight compromised intermediates on the Windows Disallowed Certificate Trust List. Of those, six were TLS intermediates and two were code-signing intermediates. The company also shipped a CRLSet update for Edge and WebView2 that blocked the affected TLS certificates without requiring a browser update. After eMudhra revoked the eight intermediates, Mozilla, Google, Apple and other vendors also began revoking them. The October 26 update goes further: it removes the eMudhra roots that Windows used to validate other certificates the CA issued. Microsoft said removing a root is not the same as revoking the known compromised intermediate CAs; it is a broader trust decision. Organizations that need compatibility can decide to trust a certificate locally, subject to their own security assessment and policies. Microsoft is still investigating the remaining eMudhra roots and may make further trust changes.

SitePoint's guide warns that non-browser runtimes such as curl, Python, Node.js, Go and Rust generally skip revocation checks by default, so they may still trust the compromised eMudhra chain even after browsers are safe. The guide provides online test endpoints at emudhra.we-have-a-problem.com and offline PEM chains to verify whether a system or language-level bundle still trusts the intermediates. Remediation steps include updating system CA packages, upgrading Python's certifi to 2026.10.19, upgrading Node.js to patched releases, running cargo update for webpki-roots, and rebuilding containers and CI runners from images that ship updated CA certificates. Microsoft's guidance for administrators is simpler: put the out-of-band update on disconnected Windows machines and locate any certificates that chain to the removed roots, since those may have to be replaced.