Microsoft Issues OOB Updates to Distrust Compromised eMudhra Certificates

Microsoft has released out-of-band (OOB) Windows updates designed to remove trust in compromised eMudhra certificate authority keys. The critical updates, KB5134133 for Windows 11 and KB5134125 for Windows 10, specifically target systems that do not receive automatic certificate trust updates, such as offline devices or those with disabled Certificate Trust List (CTL) updates.

This action aims to prevent potential certificate forgery and the interception of encrypted communications following the discovery of dangerously weak eMudhra intermediate certificate private keys. The updates were made available on 26 October, with an accompanying update to the Edge trust list scheduled for 27 October.

Broader Trust Removal and Background

The move follows the earlier discovery of eight eMudhra intermediate certificate authority private keys generated in April 2025 that were deemed critically weak. These keys had values smaller than 256, making them recoverable almost instantly by testing a limited number of possibilities. Such compromised keys could have allowed attackers to forge certificates for legitimate websites, enabling man-in-the-middle attacks to intercept encrypted traffic or sign malicious code.

In response to the disclosure, eMudhra revoked the compromised intermediate certificates, a step quickly followed by other major software vendors including Mozilla, Google, and Apple. Microsoft had also previously updated its Windows Disallowed Certificate Trust List to block the affected intermediate certificate authorities, including six used for Transport Layer Security (TLS) and two for code signing.

The latest OOB updates go further by removing seven certificates associated with the affected hierarchies from the core Windows trust list. This includes six eMudhra G3 roots and an AAA Certificate Services cross-sign. Microsoft explained that removing a root certificate from a trust list is a broader security decision than merely revoking known impacted intermediate certificate authorities, as it removes the foundational trust for any certificate issued by that root.

Recommendations for Administrators

Microsoft advises administrators to install these OOB updates on any disconnected Windows systems to ensure they are protected. Organisations must also identify and replace any certificates that rely on the now-distrusted eMudhra root certificates, as these may cease to function correctly following the update.

The company stated it is continuing to investigate other eMudhra roots and may implement additional trust changes as necessary to bolster the security posture of Windows environments against certificate-related threats.