Microsoft Issues Out-of-Band Update to Remove Trust for Compromised eMudhra Root Certificates

Key summary

Microsoft has released an out-of-band (OOB) update, KB5134133 for Windows 11 and KB5134125 for Windows 10, to remove trust for root certificates associated with the compromised eMudhra Certificate Authority. The update targets devices that cannot access automatic certificate trust updates or are offline. This action follows the discovery of eight weak intermediate CA private keys created in April 2025, which could be brute-forced with only 256 attempts due to values less than 256 bits. Microsoft previously blocked eight intermediate certificates (six for TLS and two for code signing) via the Windows Disallowed Certificate Trust List and CRLSet updates for Edge and WebView2. The latest update removes seven root certificates from the Windows trust list: six eMudhra G3 roots and one cross-sign certificate for AAA Certificate Services. These seven roots will also be removed from the Edge trust list on October 27. Organizations may retain trust for specific certificates if compatibility is required, based on internal security assessments.