Microsoft issues out-of-band Windows update to remove certificates linked to eMudhra compromise from trust list

Update targets devices that cannot automatically update certificate trust lists, also includes known issues from October patch

By LineZotpaper AI staff

Published27 October 2026

Updated27 October 2026

Read Time2 min

Sources2 outlets

Reactions1 on X

Follow this storyHear when it moves

Microsoft has released an out-of-band Windows update to remove seven certificates linked to the compromised eMudhra certification authority from the Windows trust list, targeting devices that cannot automatically receive certificate trust list updates. The non-security update, issued October 26, applies to supported Windows versions from Windows 10 to Windows Server 2025.

The update removes six eMudhra G3 roots and an AAA Certificate Services cross-sign from the Windows trust list, Microsoft said. The move follows the compromise of eMudhra's private keys earlier this month. The Indian certification authority's keys "could potentially be used to create certificates or sign content that appeared to come from a trusted CA," Microsoft said. The company also released a separate CRLSet update for Edge and WebView2.

The out-of-band update is primarily for devices that cannot access Microsoft's certificate update service or have automatic CTL updates disabled. It also incorporates everything from the October 13 update, which introduced known issues including ongoing VPN problems, a change that could break on-premises Exchange Servers, and potential oddities with Smart App Control, audio, and Remote Desktop connections for non-admin users. These issues are not resolved by this patch.

Microsoft said many devices will not need this version since current certificate list updates usually come through the update service. However, for those disconnected from that service, the update may be necessary to avoid problems when verifying certificates used by applications or websites.

RSS

The Daily Edition

The front page in your inbox each weekday morning: the lead, the picks, and why each one earned its place.

Analysis

Why This Matters

The compromise of a certification authority's private keys undermines the trust model that underpins secure web browsing and code signing, potentially allowing attackers to impersonate trusted entities.
Devices that are offline or have automatic updates disabled are especially vulnerable, making this manual update crucial for air-gapped or restricted systems in enterprise environments.
The update also bundles unresolved known issues from the October patch, meaning IT administrators must weigh the security benefit of CTL updates against the risk of introducing those bugs.

Background

Certificate trust lists (CTLs) are used by Windows to determine which certificate authorities are trusted. When a CA's private keys are compromised, Microsoft typically revokes affected certificates via automatic CTL updates. The eMudhra compromise, disclosed earlier this month, involved an Indian certification authority whose keys were stolen, prompting a broad industry cleanup. Microsoft's out-of-band release extends these revocations to systems that cannot receive automatic updates via Windows Update.

What to Watch

Whether Microsoft releases additional updates to resolve the known issues from the October 13 patch, particularly the VPN and Exchange problems.
Other technology vendors may follow with similar certificate revocation updates, as the eMudhra compromise affects more than just Windows environments.
The potential for further disclosures about the scope of the eMudhra key compromise and whether any fraudulent certificates were already in use.

Sources

Microsoft’s response to compromised eMudhra certificate authority keys · microsoft.com
Microsoft releases out-of-band Windows fixes with certificate updates · The Register

Checked

12 claims in this story checked against 2 sources: 10 supported.

Show each claim

SupportedMicrosoft issued an out-of-band Windows update to remove certificates linked to the eMudhra compromise from the Windows trust list.microsoft.com: “On October 26, Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies: six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list.”
SupportedThe update targets devices that cannot automatically receive certificate trust list updates.www.theregister.com - Articles: “It’s all about updating the current certificate trust list (CTL) of devices that cannot access Microsoft’s certificate-update service, or where automatic CTL updates are disabled.”
SupportedThe update is a non-security release for supported Windows versions spanning Windows 10 to Windows Server 2025.www.theregister.com - Articles: “The non-security out-of-band release applies to supported OSes ranging from Windows 11 and Windows Server 2025, to Windows 10.”
SupportedMicrosoft released the update on October 26.microsoft.com: “On October 26, Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies: six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list.”
SupportedThe update removes seven certificates: six eMudhra G3 roots and an AAA Certificate Services cross-sign.microsoft.com: “On October 26, Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies: six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list.”
SupportedThe update follows the compromise of eMudhra’s private keys earlier this month.www.theregister.com - Articles: “The Indian certification authority’s private keys were compromised earlier this month, requiring a massive cleanup effort.”
SupportedMicrosoft said the keys “could potentially be used to create certificates or sign content that appeared to come from a trusted CA”.microsoft.com: “Because these keys could be recovered, they could potentially be used to create certificates or sign content that appeared to come from a trusted CA.”
SupportedMicrosoft also released a separate CRLSet update for Edge and WebView2.microsoft.com: “Microsoft also deployed a separate CRLSet update for Microsoft Edge and WebView2 to block the affected TLS certificates signed by the affected certificate authorities.”
Partly supportedThe October 13 update introduced the known issues carried into the out-of-band update.www.theregister.com - Articles: “It also contains everything in the October 13 update, including the ongoing VPN issues and the change that could break on-premises Exchange Servers. There might also be oddities with Smart App Control, audio, and Remote Desktop connections for non-admin users, all of which are known issues in the October 13 update.”
SupportedThe known issues are not resolved by this patch.www.theregister.com - Articles: “These problems are not resolved in this patch, so be aware of this when installing it.”
SupportedMany devices will not need this update because current certificate list updates usually come through the update service.www.theregister.com - Articles: “It is also worth remembering that many devices will not need this version since the current certificate list updates usually come down through the update service.”
Partly supportedFor devices disconnected from the service, the update may be necessary to avoid problems verifying certificates used by applications or websites.www.theregister.com - Articles: “However, if that service isn’t available or being used, it might be a good idea to get this out-of-band fix (while keeping the known issues in mind), since problems can occur when verifying certificates used by applications or websites.”

Correction

27 October 2026An earlier version of this story said Microsoft's update revokes seven certificates linked to eMudhra. The update removes those certificates from the Windows trust list, which is distinct from revoking the affected intermediate certificates.