Microsoft has issued out-of-band Windows updates that strip trust from certificates linked to compromised eMudhra certificate authority keys, a step aimed at machines that do not receive automatic certificate trust updates. The KB5134133 update covers Windows 11 versions 24H2, 25H2, and 26H2, while KB5134125 covers Windows 10 versions 21H2 and 22H2. Both were released on October 26. The updates are intended for systems without Internet access, devices that cannot reach Microsoft's certificate-update service, and machines where automatic Certificate Trust List updates have been turned off.
The action follows the discovery of eight eMudhra intermediate certificate authority private keys that were weak enough to be recovered almost instantly. All eight were generated in April 2025 and held values smaller than 256, meaning anyone could recover them by testing just 256 possible numbers. With those keys, attackers could have forged certificates for legitimate websites and intercepted encrypted communications.
After the disclosure, eMudhra revoked the eight compromised intermediate certificates, and Mozilla, Google, Apple, and other software vendors began revoking them as well. Microsoft had already updated the Windows Disallowed Certificate Trust List to block the eight affected intermediate certificate authorities, six used for TLS and two for code signing. The company also shipped a CRLSet update for Microsoft Edge and WebView2 that blocked affected TLS certificates without requiring a browser update.
Microsoft is now going further by removing seven certificates tied to the affected hierarchies from its Windows trust list. According to Microsoft, the October 26 update removes six eMudhra G3 roots and an AAA Certificate Services cross-sign from the Windows trust list. The update also removes trust in the eMudhra root certificates used to verify other certificates issued by the CA. Microsoft said the same seven certificates will be removed from the Edge trust list on October 27.
Microsoft drew a distinction between the two kinds of trust action. Removing a root from a trust list differs from revoking the known impacted intermediate certificate authorities, the company said, describing the root removal as a separate trust decision that is broader than blocking the identified compromised intermediate keys. Organizations with a specific compatibility need may choose to trust a certificate locally, subject to their own security assessment and policies.
Administrators are advised to install the update on disconnected Windows systems and to identify any certificates that depend on the removed roots, since those certificates may need to be replaced. Microsoft said it is also investigating the remaining eMudhra roots and may make additional trust changes as needed.
More software news from TechManNews.
