Microsoft has released out-of-band Windows updates that remove trust in seven certificates tied to the compromised eMudhra certificate authority, according to a Microsoft Security Response Center blog post. KB5134133 covers Windows 11 versions 24H2, 25H2, and 26H2, while KB5134125 covers Windows 10 versions 21H2 and 22H2. Both updates were released on October 26.
The updates target a specific group of devices: systems without Internet access, devices that cannot reach Microsoft's certificate update service, and machines where automatic Certificate Trust List (CTL) updates are turned off. Windows devices that receive CTL updates normally already get trust changes through that channel.
Why Microsoft Is Removing the eMudhra Roots
The release follows the discovery of eight eMudhra intermediate certificate authority private keys that were weak enough to be recovered almost instantly. All eight keys were generated in April 2025 and had values smaller than 256, which meant anyone could recover them by testing just 256 possible numbers. With those keys, attackers could have forged certificates for legitimate websites and intercepted encrypted traffic.
eMudhra revoked the eight intermediate certificates after the disclosure. Mozilla, Google, and Apple also started revoking them in their products.
Microsoft's first response was an update to the Windows Disallowed Certificate Trust List that blocked the eight intermediate authorities, six of them used for TLS and two for code signing. A CRLSet update for Microsoft Edge and WebView2 blocked the affected TLS certificates without a browser update.
The new out-of-band release goes a step further. Microsoft says it "removes seven certificates associated with the affected hierarchies: six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list." Microsoft also says the same seven certificates are being removed from the Edge trust list on October 27.
The company stresses that removing a root is a broader trust decision than revoking the known compromised intermediates. Organizations with a specific compatibility requirement can choose to trust a certificate locally, subject to their own security assessment and policies.
What Administrators Should Do Now
Microsoft advises administrators to install the update on disconnected Windows systems and to check for certificates that chain to the removed roots, since those certificates may need replacement.
- Identify Windows 11 24H2, 25H2, or 26H2 devices and Windows 10 21H2 or 22H2 devices that are offline, cannot reach Microsoft's certificate update service, or have automatic CTL updates disabled.
- Install KB5134133 on the Windows 11 systems and KB5134125 on the Windows 10 systems.
- Audit internal services, applications, and signed code for certificates issued under the six eMudhra G3 roots or the AAA Certificate Services cross-sign.
- Replace affected certificates, or document a local trust exception only where a compatibility need has passed an internal security review.
Devices that already receive automatic CTL updates do not need the out-of-band package for this change. Microsoft is still investigating the remaining eMudhra roots and says it may make additional trust changes as needed.
Thank you for being a Ghacks reader. The post Microsoft Releases Out-of-Band Windows Updates That Remove Trust in Compromised eMudhra Certificates appeared first on gHacks.
0 Commentaires