Microsoft has released out-of-band Windows updates to remove trust in certificates issued by eMudhra's compromised certificate authority keys, protecting systems that do not receive automatic certificate trust updates.
The vulnerability or weakness
The vulnerability stemmed from eMudhra's generation of intermediate certificate authority keys with values smaller than 256, allowing anyone to recover them by testing just 256 possible numbers.
Earlier attacks and coverage
- Microsoft: Windows Server 2016 reaches end of support in January (2026-10-23)
- Microsoft fixes game, app crashes caused by recent Windows update (2026-10-19)
Business impact
This incident could potentially impact organizations by allowing attackers to forge certificates for legitimate websites and intercept encrypted communications, leading to potential data breaches and loss of trust.
Industries affected
The incident affects various industries, including technology, finance, and e-commerce, where secure communication and authentication are critical.
Users affected
Users and organizations running Windows 10 and 11 versions without Internet access or automatic certificate trust updates are affected, as the updates are designed to protect these systems from potential threats.
Build these skills
Watch the daily brief
Sources
- Microsoft releases Windows OOB updates to distrust eMudhra certificates (BleepingComputer)
