Microsoft Pushes Out-of-Band Windows Update to Distrust Compromised eMudhra Certificate Authority Keys

Scope: Windows systems not receiving automatic certificate trust list updates

Severity: Amber

Microsoft released an out-of-band Windows update on October 27, 2026, removing trust in certificates tied to compromised eMudhra certificate authority keys. eMudhra, a certificate authority, had previously revoked eight weak CA certificates after they were found vulnerable, and this Windows update ensures systems that do not automatically receive updated certificate trust lists are still protected from certificates issued under the compromised keys. A compromised certificate authority key can be used to issue fraudulent certificates that appear legitimate to browsers and operating systems, enabling man-in-the-middle attacks, impersonation of trusted websites, and interception of supposedly secure connections. Organisations running Windows systems, particularly in managed environments where certificate trust list updates may be delayed or disabled by policy, must apply this out-of-band update today to ensure compromised eMudhra certificates are no longer trusted.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.