Microsoft Windows: Updates to address compromised eMudhra certificate authority keys

Microsoft is updating Windows, Edge, and WebView2 to block eight compromised eMudhra certificate authority keys by late October 2026. Organizations must allow automatic updates, manage disconnected devices, and replace certificates chaining to these keys to maintain trust and security. Microsoft is responding to an issue involving eight eMudhra intermediate certificate authority (CA) private keys, six associated with TLS and two with code signing. Because these keys could be recovered, they could potentially be used to create certificates or sign content that appeared to come from a trusted CA. The issue arose in eMudhra’s certificate hierarchy and was not a compromise of Microsoft systems. Microsoft is updating certificate trust to block affected certificate authorities and remove certificates associated with the affected hierarchies. Rollout schedule General Availability (Worldwide, GCC, GCC High, DoD): Beginning in late October 2026 and expected to complete by late October 2026 Impact on your organization Who is affected Organizations using Windows, Microsoft Edge, or WebView2, particularly organizations with certificates that chain to one of the eight certificates being removed Organizations managing disconnected Windows devices or disconnected Azure devices may need to take additional action Platforms and services Windows Microsoft Edge WebView2 Azure virtual machines What will happen Microsoft has published an update to the Windows Disallowed Certificate Trust List to block the affected certificate authorities. Microsoft has deployed a separate CRLSet update for Microsoft Edge and WebView2 to block affected TLS certificates signed by the affected certificate authorities. The Microsoft Edge and WebView2 update is delivered automatically through the component update mechanism. Customers do not need to install a new browser version. Microsoft has released updates to Windows and Microsoft Edge to remove certificates associated with the affected hierarchies from their trust lists. After these updates reach a device, the affected certificates will no longer be trusted by default through the respective trust lists. Action required and recommendations Keep updates flowing. Allow automatic Windows certificate trust updates and Microsoft Edge component updates to reach your devices. Check disconnected Windows devices. If you manage Windows devices that do not receive automatic updates, make sure your update process delivers the […]

The post Microsoft Windows: Updates to address compromised eMudhra certificate authority keys appeared first on M365 Admin.