Microsoft Releases Emergency Windows Updates to Block Compromised eMudhra Certificates

Microsoft released emergency Windows trust updates after discovering eight recoverable eMudhra intermediate CA private keys that could let attackers forge trusted certificates or sign malicious content.

Microsoft said the issue affected eMudhra’s certificate hierarchy, not Microsoft systems. The response includes an October 26 out-of-band Windows update removing seven certificates from the Windows trust list.

Microsoft confirmed on October 27 that it had removed the same certificates from the Microsoft Edge trust list, extending its response beyond earlier blocks against the compromised intermediates.

Six affected keys relate to Transport Layer Security, or TLS, which helps protect connections to websites and services. The other two relate to code signing, which helps systems check who published software. Recovering these keys could let attackers misuse the trust attached to their certificate authorities.

An attacker using a compromised TLS key could create a certificate to impersonate a website or service and potentially intercept communications. The code-signing keys could make malicious software appear to come from a trusted publisher. These are potential uses of the keys, not proof that such attacks occurred.

Microsoft Updates to Block eMudhra Certificates

Cyber Security News previously covered the eMudhra certificate authority compromise and the blocks introduced across major platforms. Its reporting on abuse of Microsoft Artifact Signing also shows why a trusted software signature does not guarantee that a file is safe.

Microsoft first updated the Windows Disallowed Certificate Trust List on October 20 to block the affected certificate authorities. It also deployed a separate CRLSet update for Edge and WebView2 to block affected TLS certificates. That browser protection arrives automatically through component updates without requiring a new browser version.

The later Windows update removes six eMudhra G3 root certificates and an AAA Certificate Services cross-sign. Removing these seven certificates is a broader trust decision, separate from blocking the eight compromised intermediate keys and from eMudhra’s revocation of the affected intermediate certificates.

Microsoft warned against restoring trust locally without assessing the risks. Software that does not reliably check certificate revocation or Microsoft’s disallowed list could still accept certificates linked to the compromised intermediates if the removed trust is retained or restored.

Organizations should allow Windows certificate trust updates and Edge component updates to reach managed devices. Disconnected Windows systems need special attention because administrators must provide an alternative way to update.

Microsoft’s certificate trust guidance explains how to distribute trusted and disallowed certificate lists through internal infrastructure.

Microsoft also urged customers to review disconnected Azure virtual machines and Virtual Machine Scale Sets. Updated images are available through Azure Marketplace.

Certificate owners should identify chains that depend on the seven removed certificates and obtain replacements or an alternative trusted chain.

Microsoft is evaluating remaining eMudhra roots separately as customers move away from affected hierarchies. Administrators can monitor Microsoft Trusted Root Program announcements for published changes and verify that certificate updates reach every managed system.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Microsoft Releases Emergency Windows Updates to Block Compromised eMudhra Certificates appeared first on Cyber Security News.