Microsoft has released a Windows out-of-the-band (OOB) update to remove trust in certificates associated with compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates.
Yes KB5134133 Updates for Windows 11 versions 24H2, 25H2, and 26H2 and KB5134125 Updates for Windows 10 versions 21H2 and 22H2 were released on October 26.
The update is for systems without Internet access, devices that do not have access to Microsoft’s Certificate Update Service, and those that disable automatic Certificate Account (CTL) updates.
The update was released after the discovery of eight eMudhra intermediate certificates whose private keys were so weak they could be recovered almost immediately.
All 8 keys were generated in April 2025 and have a value less than 256, allowing anyone to recover them by testing only 256 possible numbers.
Compromised keys can allow attackers to forge certificates for legitimate websites and intercept encrypted communications.
After the disclosure, eMudhra revoked eight compromised intermediate certificates, and Mozilla, Google, Apple, and other software vendors began revoking them.
In response, Microsoft previously updated the Windows Disallowed Certificate Trust List to block eight affected intermediate certificate authorities, including six used for TLS and two for key signing.
The company also released a CRLset update for Microsoft Edge and WebView2 to block affected TLS certificates, which can be blocked without a browser update.
Microsoft is now taking a step further by removing seven certificates related to the affected certificate hierarchy from the Windows trust list.
“On October 26, Microsoft released a non-band Windows update that removed seven certificates related to the affected hierarchy: the six root eMudhra G3 and AAA Certificate Services, from the Windows trust list,” Microsoft Explain.
The update goes further by removing trust in the eMudhra root certificate used to verify other certificates issued by CAs.
Microsoft said the same 7 certificates will also be removed from the Edge trust list on October 27.
“Removing root from the trust list is not the same as removing an affected intermediate certificate,” Microsoft explains.
“This is a separate, broader trust decision than blocking a compromised intermediate key. Organizations with specific compatibility needs may choose to trust certificates locally, depending on their own security assessments and policies.”
The company recommends that administrators install updates on disconnected Windows systems and identify any root-dependent certificates that have been removed, as they may need to be replaced.
Microsoft is still investigating the remaining eMudhra root and may make additional trust changes as needed.
Overall defense scores can hide what happens after initial access. When attackers are using valid credentials, defenses are greatly reduced.
The Blue Report 2026 measures defense technique by technique across 338 million simulations run in customer production environments.
