MC1529467 - Microsoft Windows: Updates to address compromised eMudhra certificate authority keys

Microsoft 365 Message Center announcement MC1529467.

MS Message Center's Summary

Microsoft is updating Windows, Edge, and WebView2 in late October 2026 to block eight compromised eMudhra certificate authority keys. Administrators must ensure automatic updates remain enabled, audit certificate chains for dependencies on the affected authorities, and manually update disconnected devices or virtual machines to prevent trust validation failures.

Administrator impact
Administrators must verify certificate chains and ensure disconnected devices receive updated trust lists.
End user impact
End users may experience connection failures or trust warnings if their applications rely on certificates chained to the revoked authorities.
Importance
8/10: This security update revokes compromised certificate authority keys, which can break application trust if internal certificates rely on the affected chains.

Microsoft response to compromised eMudhra certificate authority keys

Configure trusted roots and disallowed certificates in Windows

Microsoft Summary

Microsoft is updating Windows, Edge, and WebView2 to block eight compromised eMudhra certificate authority keys by late October 2026. Organizations must allow automatic updates, manage disconnected devices, and replace certificates chaining to these keys to maintain trust and security.

Message Center ID
MC1529467
Category
plan For Change
Severity
normal
Services
Microsoft 365 suite
Tags
User impact, Admin impact
Published
2026-10-28
Last updated
2026-10-28
Expires
2026-11-28

[What and why] Microsoft is responding to an issue involving eight eMudhra intermediate certificate authority (CA) private keys, six associated with TLS and two with code signing. Because these keys could be recovered, they could potentially be used to create certificates or sign content that appeared to come from a trusted CA. The issue arose in eMudhra's certificate hierarchy and was not a compromise of Microsoft systems. Microsoft is updating certificate trust to block affected certificate authorities and remove certificates associated with the affected hierarchies. [Rollout schedule] General Availability (Worldwide, GCC, GCC High, DoD): Beginning in late October 2026 and expected to complete by late October 2026 [Impact on your organization] Who is affected Organizations using Windows, Microsoft Edge, or WebView2, particularly organizations with certificates that chain to one of the eight certificates being removed Organizations managing disconnected Windows devices or disconnected Azure devices may need to take additional action Platforms and services Windows Microsoft Edge WebView2 Azure virtual machines What will happen Microsoft has published an update to the Windows Disallowed Certificate Trust List to block the affected certificate authorities. Microsoft has deployed a separate CRLSet update for Microsoft Edge and WebView2 to block affected TLS certificates signed by the affected certificate authorities. The Microsoft Edge and WebView2 update is delivered automatically through the component update mechanism. Customers do not need to install a new browser version. Microsoft has released updates to Windows and Microsoft Edge to remove certificates associated with the affected hierarchies from their trust lists. After these updates reach a device, the affected certificates will no longer be trusted by default through the respective trust lists. [Action required and recommendations] Keep updates flowing. Allow automatic Windows certificate trust updates and Microsoft Edge component updates to reach your devices. Check disconnected Windows devices. If you manage Windows devices that do not receive automatic updates, make sure your update process delivers the updated Disallowed Certificate Trust List and upcoming trust-list changes. See the Microsoft Learn guidance in Learn more for information about distributing certificate trust lists in disconnected environments. Review disconnected Azure devices. Review disconnected Azure devices running on Virtual Machine Scale Sets (VMSS) or single-instance VMs. Updated images are available in Azure Marketplace, and customers can deploy them to protect against this vulnerability. Replace dependent certificates. If any of your certificates chain to one of the seven certificates being removed, identify those dependencies and obtain replacement certificates or an alternative trusted chain before the changes reach your devices. Learn more Microsoft’s response to compromised eMudhra certificate authority keys Configure trusted roots and disallowed certificates in Windows | Microsoft Learn [Compliance considerations] No compliance considerations identified. Review as appropriate for your organization.