The facts

  1. Microsoft identified eight affected intermediate keys: six used for TLS and two for code signing. It did not report that eMudhra's root keys or Microsoft's systems had been compromised. [1]

  2. The seven distrusted certificates comprise six eMudhra G3 roots and an AAA Certificate Services cross-sign. This is broader than blocking the eight intermediate certificates on 20 October. [1]

  3. Windows emergency updates include KB5134133 for Windows 11 24H2, 25H2 and 26H2, and KB5134125 for Windows 10 21H2 and 22H2. [2]

  4. Microsoft says disconnected systems, or systems with automatic trust-list updates disabled, require manual attention; services depending on distrusted chains need replacement certificates. [1]

Still unconfirmed

  • The reviewed sources do not establish whether attackers actually misused the keys.

Sources

References support the numbered facts above. Source checks: 29 Oct 2026, 07:46 UTC.

  1. Response to compromised eMudhra certificate-authority keys

    Microsoft Security Response Center · Primary source · 26 Oct 2026

    Updated 27 October.

  2. Microsoft releases Windows OOB updates to distrust eMudhra certificates

    BleepingComputer · Reporting · 27 Oct 2026

Report a factual error