Microsoft has released an out-of-band Windows update that removes trust in certificates linked to compromised eMudhra certificate authority keys. The update is intended to protect systems that cannot receive automatic certificate trust updates, including disconnected devices and systems with automatic certificate trust list updates disabled.
Microsoft releases emergency Windows updates
Microsoft released the updates on October 26. KB5134133 applies to Windows 11 versions 24H2, 25H2, and 26H2, while KB5134125 applies to Windows 10 versions 21H2 and 22H2.
The updates are designed for systems without Internet access, devices that cannot connect to Microsoft’s Certificate Renewal Service, and systems where automatic certificate trust list (CTL) updates have been disabled.
Weak eMudhra keys exposed certificates
The updates follow the discovery that eight eMudhra intermediate certificate authority private keys were weak enough to be recovered almost instantly.
All eight keys were generated in April 2025 and had values below 256. An attacker could therefore recover them by testing the 256 possible values.
A compromised private key could be used to forge a certificate for a legitimate website, potentially enabling an attacker to intercept encrypted communications.
Following the discovery, eMudhra revoked the eight compromised intermediate certificates. Mozilla, Google, Apple, and other software vendors also began revoking the affected intermediate certificates.
Windows trust lists updated
Microsoft previously updated the Windows Disallowed Certificate Trust List to block the eight affected intermediate certificate authorities. Six of the certificates were used for Transport Layer Security (TLS), while two were used for code signing.
Microsoft also released a CRLSet update for Microsoft Edge and WebView2. This blocks the affected TLS certificates without requiring a browser update.
The latest Windows update goes further by removing seven certificates associated with the affected certificate hierarchy from the Windows trust list. Microsoft said the certificates include six eMudhra G3 root and AAA Certificate Services cross-signs.
“On October 26, Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies (six eMudhra G3 root and AAA Certificate Services cross-signs) from the Windows trust list,” the company explained.
The update also removes trust in the eMudhra root certificate, which is used to validate other certificates issued by the certificate authority.
Microsoft said the same seven certificates would be removed from the Edge trust list on October 27.
Potential compatibility impact
Microsoft emphasized that removing a root certificate from the trust list differs from revoking a known compromised intermediate certificate authority.
“This is a separate trust decision that is broader than blocking an identified compromised intermediate key,” Microsoft said. “Organizations with specific compatibility needs may choose to trust certificates locally according to their own security assessments and policies.”
The company advises administrators to install the updates on disconnected Windows systems and identify certificates that depend on the removed roots, as those certificates may need to be replaced.
Microsoft is continuing to investigate the remaining eMudhra roots and may make additional trust changes if necessary.
Source: www.bleepingcomputer.com