Microsoft Windows: Updates to address compromised eMudhra certificate authority keys

[What and why]

Microsoft is responding to an issue involving eight eMudhra intermediate certificate authority (CA) private keys, six associated with TLS and two with code signing. Because these keys could be recovered, they could potentially be used to create certificates or sign content that appeared to come from a trusted CA. The issue arose in eMudhra's certificate hierarchy and was not a compromise of Microsoft systems.

Microsoft is updating certificate trust to block affected certificate authorities and remove certificates associated with the affected hierarchies.

[Rollout schedule]

• General Availability (Worldwide, GCC, GCC High, DoD): Beginning in late October 2026 and expected to complete by late October 2026

[Impact on your organization]

Who is affected

• Organizations using Windows, Microsoft Edge, or WebView2, particularly organizations with certificates that chain to one of the eight certificates being removed
• Organizations managing disconnected Windows devices or disconnected Azure devices may need to take additional action

Platforms and services

• Windows
• Microsoft Edge
• WebView2
• Azure virtual machines

What will happen

• Microsoft has published an update to the Windows Disallowed Certificate Trust List to block the affected certificate authorities.
• Microsoft has deployed a separate CRLSet update for Microsoft Edge and WebView2 to block affected TLS certificates signed by the affected certificate authorities.
• The Microsoft Edge and WebView2 update is delivered automatically through the component update mechanism. Customers do not need to install a new browser version.
• Microsoft has released updates to Windows and Microsoft Edge to remove certificates associated with the affected hierarchies from their trust lists.
• After these updates reach a device, the affected certificates will no longer be trusted by default through the respective trust lists.

[Action required and recommendations]

• Keep updates flowing. Allow automatic Windows certificate trust updates and Microsoft Edge component updates to reach your devices.
• Check disconnected Windows devices. If you manage Windows devices that do not receive automatic updates, make sure your update process delivers the updated Disallowed Certificate Trust List and upcoming trust-list changes. See the Microsoft Learn guidance in Learn more for information about distributing certificate trust lists in disconnected environments.
• Review disconnected Azure devices. Review disconnected Azure devices running on Virtual Machine Scale Sets (VMSS) or single-instance VMs. Updated images are available in Azure Marketplace, and customers can deploy them to protect against this vulnerability.
• Replace dependent certificates. If any of your certificates chain to one of the seven certificates being removed, identify those dependencies and obtain replacement certificates or an alternative trusted chain before the changes reach your devices.

Learn more

• Microsoft’s response to compromised eMudhra certificate authority keys
• Configure trusted roots and disallowed certificates in Windows | Microsoft Learn

[Compliance considerations]

No compliance considerations identified. Review as appropriate for your organization.