Microsoft has released emergency Windows updates to remove trust in certificates associated with compromised eMudhra certificate authority keys, helping protect systems that cannot receive automatic certificate trust updates.
The out-of-band updates, released on October 26, include KB5134133 for Windows 11 versions 24H2, 25H2 and 26H2, and KB5134125 for Windows 10 versions 21H2 and 22H2. Microsoft is targeting devices that lack internet access, cannot reach its certificate update service or have automatic Certificate Trust List (CTL) updates disabled.
The updates follow the discovery of eight compromised intermediate certificate authority private keys belonging to eMudhra. According to the disclosure, all eight keys were generated in April 2025 with values smaller than 256, making them vulnerable to recovery by testing a very small number of possible values. Attackers who obtained the keys could potentially use them to forge certificates for legitimate websites or undermine encrypted communications.
Following the discovery, eMudhra revoked the affected intermediate certificates, while major technology companies, including Microsoft, Mozilla, Google and Apple, took steps to block them. Microsoft previously updated its Windows Disallowed Certificate Trust List to prevent the affected certificate authorities from being trusted. It also released a CRLSet update for Microsoft Edge and WebView2 to block the affected TLS certificates without requiring a browser update.
The latest Windows updates take the response further by removing seven certificates associated with the affected certificate hierarchies from the Windows trust list. These include six eMudhra G3 root certificates and an AAA Certificate Services cross-sign certificate. Microsoft also planned to remove the same certificates from the Edge trust list on October 27.
Microsoft explained that removing a root certificate from a trust list is a broader measure than revoking the specific compromised intermediate certificates. The change affects the system’s decision to trust certificates linked to the affected hierarchies, rather than simply blocking the eight known compromised intermediate authorities.
The company warned that organizations relying on certificates issued under the affected roots could experience compatibility problems after installing the updates. Administrators should identify certificates that depend on the removed roots and replace them where necessary. Organizations with specific compatibility requirements may also choose to trust individual certificates locally, provided they conduct an appropriate security assessment and follow their internal policies.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Microsoft is continuing to investigate the remaining eMudhra root certificates and may introduce further trust changes if necessary. The company recommends installing the emergency updates on affected Windows systems, particularly devices that cannot receive automatic certificate trust updates.
