Microsoft Issues Out‑of‑Band Windows Updates to Distrust Compromised eMudhra Certificates

What happened

Microsoft published two out‑of‑band updates (KB5134133 for Windows 11 and KB5134125 for Windows 10) that remove trust in seven eMudhra root and intermediate certificates. The action follows the discovery that eight eMudhra intermediate private keys were generated with insufficient entropy (< 256 bits), allowing immediate reconstruction. If exploited, attackers could forge TLS or code‑signing certificates, enabling interception of encrypted communications. The updates target systems without Internet access or with disabled automatic CTL updates, and a CRLSet was pushed to Edge/WebView2 to enforce the block without a browser update.

Why it matters for trust and compliance

• This incident demonstrates the need for a control that continuously monitors third‑party certificate authorities and documents revocation decisions, a key element of supply‑chain risk management.
• Implement continuous monitoring of public‑CA revocation feeds to provide real‑time evidence of trust decisions.
• Document and test your certificate‑validation process to satisfy audit requirements across frameworks.

Who is affected

Recommended actions

1. Apply the OOB updates to all affected Windows installations.
2. Inventory and replace any certificates that chain to the removed eMudhra roots.