**Microsoft** has taken decisive action to address a significant security vulnerability, issuing emergency Windows updates to revoke trust in compromised **eMudhra** certificate authority keys. This move is particularly crucial for systems operating without direct internet access or those with disabled automatic Certificate Trust List (CTL) updates. ### Critical Updates Released The updates, **KB5134133** for **Windows 11** (versions 24H2, 25H2, and 26H2) and **KB5134125** for **Windows 10** (versions 21H2 and 22H2), were rolled out on October 26. These out-of-band releases ensure that even isolated environments are protected from potential threats stemming from the compromised certificates. ### The eMudhra Compromise The necessity for these updates arose from the discovery of eight **eMudhra** intermediate certificate authority private keys with critically weak cryptographic values. Generated in April 2025, these keys had values smaller than 256, making them susceptible to near-instant recovery by attackers. Such a compromise could enable threat actors to forge legitimate website certificates and intercept encrypted communications, posing a severe risk to data privacy and integrity. Following the disclosure, **eMudhra** promptly revoked the compromised intermediate certificates. Major browser vendors, including **Mozilla**, **Google**, and **Apple**, also initiated revocation processes. ### Microsoft's Layered Response Previously, **Microsoft** updated the Windows Disallowed Certificate Trust List to block the eight affected intermediate certificate authorities, which included six used for TLS and two for code signing. The company also pushed a **CRLSet** update for **Microsoft Edge** and **WebView2**, enabling the block of affected TLS certificates without requiring a browser update. Going a step further, the latest OOB updates remove seven certificates associated with the affected certificate hierarchies directly from the Windows trust list. This includes six **eMudhra G3** roots and an **AAA Certificate Services** cross-sign. "On October 26, **Microsoft** released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies: six **eMudhra G3** roots and an **AAA Certificate Services** cross-sign, from the Windows trust list," **Microsoft** explained. This action is broader than merely revoking known impacted intermediate certificates, as it removes trust in the root certificates used to verify other certificates issued by the CA. The same seven certificates are also slated for removal from the **Edge** trust list on October 27. ### Recommendations for IT Security Professionals **Microsoft** urges administrators to install these critical updates on all disconnected Windows systems. Furthermore, organizations should identify any certificates that depend on the removed roots, as these may need to be replaced to maintain operational continuity and security posture. **Microsoft** continues to investigate the remaining **eMudhra** roots, indicating that additional trust changes may be implemented as necessary to safeguard the Windows ecosystem.