All eight compromised intermediate keys tied to the Indian certificate authority eMudhra were generated in April 2025 with values smaller than 256 — meaning an attacker could recover them by testing just 256 possible numbers, and so "could have allowed attackers to forge certificates for legitimate websites and intercept encrypted communications."
Microsoft’s out-of-band Windows updates: KB5134133 and KB5134125
On October 26, Microsoft released two out-of-band (OOB) Windows updates to remove trust in certificates tied to the compromised eMudhra hierarchies. The KB5134133 update targets Windows 11 versions 24H2, 25H2, and 26H2; the KB5134125 update covers Windows 10 versions 21H2 and 22H2. Microsoft said the updates are intended for systems that do not receive automatic certificate trust updates — specifically, systems without Internet access, devices that cannot access Microsoft's certificate-update service, and machines where automatic Certificate Trust List (CTL) updates have been disabled.
What Microsoft removed and when
Microsoft explained, "On October 26, Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies: six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list." The company said the new update also removes trust in the eMudhra root certificates used to verify other certificates issued by the CA. Microsoft stated the same seven certificates will be removed from the Edge trust list on October 27.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHow the eMudhra keys were weak and industry reaction
Security analysis of the incident found eight eMudhra intermediate certificate authority private keys were so weak they could be recovered almost instantly. All eight keys were generated in April 2025 and had values smaller than 256, allowing anyone to recover them by testing just 256 possible numbers. Because those keys could be used to sign certificates, they "could have allowed attackers to forge certificates for legitimate websites and intercept encrypted communications." After disclosure, eMudhra revoked the eight compromised intermediate certificates, and Mozilla, Google, Apple, and other software vendors began revoking them as well.
Browser and prior Microsoft mitigations
Before the OOB Windows updates, Microsoft had already taken steps to block the immediate risk. The company updated the Windows Disallowed Certificate Trust List to block the eight affected intermediate certificate authorities — six used for TLS and two for code signing. Microsoft also released a CRLSet update for Microsoft Edge and WebView2 to block affected TLS certificates, a mechanism that "enabled the block without requiring a browser update." Those measures addressed the known compromised intermediates; the October 26 Windows update extends the scope by removing trust in associated roots.
What this means for administrators, enterprise buyers, and end users
- Technologists and security teams: Microsoft advises administrators to install the OOB update on disconnected Windows systems and to identify any certificates that depend on the removed roots, because those certificates "may need to be replaced."
- Enterprise procurement and compatibility teams: Microsoft cautioned that "Removing a root from a trust list is not the same as revoking the known impacted intermediate certificate authorities" and that "Organizations with a specific compatibility need may choose to trust a certificate locally, subject to their own security assessment and policies."
- End users and endpoint operators: Browser-level protections via the CRLSet update for Edge and WebView2 reduced exposure without immediate browser updates, but systems that do not receive CTL or other automated trust updates remain the primary target for the Windows OOB patches.
Microsoft said it is investigating the remaining eMudhra roots and "may make additional trust changes as needed." The distinction the company emphasizes is operational: blocking compromised intermediates and removing roots from trust lists are separate, cumulative actions that change how trust is computed across tens of millions of endpoints — and which may force administrators to inventory and replace certificates that relied on the now-removed roots.
