Microsoft Releases Out-of-Band Windows Updates to Untrust eMudhra Certificates

Microsoft has released out-of-band (OOB) Windows updates to remove trust in specific certificates tied to compromised eMudhra certificate authority keys. This action aims to protect systems that do not receive automatic certificate trust updates.

According to the announcement, the KB5134133 update applies to Windows 11 versions 24H2, 25H2, and 26H2, while the KB5134125 update covers Windows 10 versions 21H2 and 22H2. Both updates were released on October 26.

Purpose of the Out-of-Band Updates

• Target Audience: The releases are intended for systems without internet access, devices unable to reach Microsoft's certificate-update service, and environments where automatic Certificate Trust List (CTL) updates are disabled.
• Key Removal: The updates remove seven certificates associated with the affected hierarchies from the Windows trust list, specifically six eMudhra G3 roots and an AAA Certificate Services cross-sign.
• Browser Impact: Microsoft stated that the same seven certificates would also be removed from the Edge trust list on October 27.

Background on the eMudhra Key Compromise

The updates follow the discovery of eight eMudhra intermediate certificate authority private keys generated in April 2025. Reports indicate these keys were exceptionally weak, having values smaller than 256, which theoretically allowed recovery by testing a limited set of numbers.

• Potential Risks: Weak keys could have allowed attackers to forge certificates for legitimate websites and intercept encrypted communications.
• Vendor Responses: Following disclosure, eMudhra revoked the eight compromised intermediate certificates, and other vendors including Mozilla, Google, and Apple began taking revocation steps.

Practical Implications and Verification

Microsoft notes that removing a root from a trust list is a broader security decision than blocking impacted intermediate certificate authorities.

• Administrator Guidance: Administrators are advised to install the updates on disconnected systems and review certificates depending on the removed roots, as replacements might be necessary.
• Local Policies: Organizations with specific compatibility needs can choose to trust a certificate locally based on their own security assessments.
• Ongoing Investigation: Microsoft is continuing to investigate remaining eMudhra roots and may introduce additional trust changes in the future.

To verify original announcements and deployment details, administrators should consult official Microsoft security advisories and support channels.