Affected Systems
Windows 10 (21H2, 22H2) and Windows 11 (24H2, 25H2, 26H2). Affects systems without automatic Certificate Trust List updates, air-gapped networks, and devices without internet access. Seven eMudhra root certificates and eight intermediate CAs removed from Windows trust store.
Exploitation Status
Eight eMudhra intermediate CA private keys were compromised due to weak key generation (values <256, recoverable instantly). Keys generated April 2025. No confirmed active exploitation reported, but forged certificates for TLS interception and code signing were technically feasible.
Business Impact
Organizations using eMudhra-issued certificates will experience trust failures after update installation. Certificates signed by the seven removed root CAs (six eMudhra G3 roots, one AAA Certificate Services cross-sign) will no longer be trusted. Air-gapped and disconnected systems require manual patching via KB5134133 (Win11) or KB5134125 (Win10). Systems with automatic CTL updates already protected via earlier disallowed list changes. Risk of man-in-the-middle attacks if compromised keys were exploited before revocation.
Urgency
🟠Within 24 hours
Recommended Actions
- Deploy KB5134133 (Windows 11 24H2/25H2/26H2) or KB5134125 (Windows 10 21H2/22H2) immediately to air-gapped and disconnected systems
- Inventory all certificates issued by eMudhra G3 roots and AAA Certificate Services cross-sign; plan replacement for affected TLS and code-signing certificates
- Verify automatic Certificate Trust List updates are enabled on internet-connected Windows systems to receive ongoing trust changes
- Review web proxy, VPN, and internal application certificates for eMudhra chain dependencies; coordinate with vendors for reissuance
- Monitor Microsoft security advisories for additional eMudhra root removals as investigation continues