Microsoft has released out-of-band Windows updates that remove trust in seven certificates tied to the eMudhra certificate authority, the Indian company whose weak intermediate keys we covered last week. Those eight intermediate keys were generated in April 2025 with values small enough to be recovered almost instantly, which in principle would let someone forge certificates that look trusted. On 20 October Microsoft had already blocked the eight intermediates through the Windows Disallowed Certificate Trust List, and it pushed a CRLSet update to Edge and WebView2.
The new step is broader. According to Microsoft’s Security Response Center, the 26 October update removes six eMudhra G3 roots and an AAA Certificate Services cross-sign from the Windows trust list, and the same seven certificates leave the Edge trust list on 27 October. Microsoft stresses that removing a root is a separate trust decision from revoking the compromised intermediates, and that it is still evaluating eMudhra’s remaining roots and may make further changes. BleepingComputer reports the updates target systems without internet access, devices that cannot reach Microsoft’s certificate-update service, and those where automatic Certificate Trust List updates are turned off.
How to check if you’re affected
Affected devices are mainly managed or offline Windows PCs and servers that do not receive automatic certificate trust updates; Microsoft says to keep automatic Windows certificate trust updates and Edge component updates flowing.
- Install the right out-of-band update on disconnected systems: KB5134133 for Windows 11 versions 24H2, 25H2 and 26H2, or KB5134125 for Windows 10 versions 21H2 and 22H2. Both were released on 26 October.
- Find any certificates in your environment that chain to one of the seven removed roots, and get replacement certificates or an alternative trusted chain before the change reaches your devices.
- Check disconnected Azure devices on Virtual Machine Scale Sets or single-instance VMs; Microsoft says updated images are available in Azure Marketplace.
- Organizations with a specific compatibility need can trust a certificate locally, but Microsoft warns not to restore trust in an affected hierarchy without understanding the risk.
Sources
- Microsoft Security Response Center: Microsoft’s response to compromised eMudhra certificate authority keys
- Microsoft Support: KB5134133 (Windows 11 24H2, 25H2, 26H2), out-of-band update of 26 October 2026
- Microsoft Support: KB5134125 (Windows 10 21H2, 22H2), out-of-band update of 26 October 2026
- BleepingComputer: Microsoft releases Windows OOB updates to distrust eMudhra certificates