Microsoft Issues OOB Windows Updates to Untrust eMudhra
Microsoft has issued out-of-band Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, specifically targeting systems that do not receive automatic updates.
Radwan AbdulhadiEditor and technology writer
Out-of-Band Windows Updates Released
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates. The KB5134133 update for Windows 11 versions 24H2, 25H2, and 26H2 and the KB5134125 update for Windows 10 versions 21H2 and 22H2 were deployed to address security requirements.
These updates are designed specifically for systems without internet access, devices that cannot access Microsoft's certificate-update service, and those where automatic Certificate Trust List (CTL) updates have been disabled. Following the security situation, other major technology entities including Mozilla, Google, and Apple also took steps to block the affected certificates.
Compromised eMudhra Private Keys
The updates were released after the discovery of eight eMudhra intermediate certificate authority private keys that were so weak they could be recovered almost instantly. All eight keys were generated in April 2025 and had values smaller than 256, allowing anyone to recover them by testing just 256 possible numbers.
These compromised keys could have allowed attackers to forge certificates for legitimate websites and intercept encrypted communications. Following the disclosure, eMudhra revoked the eight compromised intermediate certificates, prompting extensive protective measures across the software ecosystem.
Broader Trust Decisions and Removals
In response to the incident, Microsoft previously updated the Windows Disallowed Certificate Trust List to block the eight affected intermediate certificate authorities, which included six used for TLS and two for code signing. The company also released a CRLSet update for Microsoft Edge and WebView2 to block affected TLS certificates without requiring a browser update.
Microsoft is now taking further steps by removing seven certificates associated with the affected certificate hierarchies from its Windows trust list. Additional technical context and company statements have been outlined by Microsoft as detailed in their official security documentation.
Administrator Guidance and Next Steps
Microsoft noted that removing a root from a trust list differs from revoking known impacted intermediate certificate authorities. This represents a separate trust decision that is broader than simply blocking the identified compromised intermediate keys.
Organizations with specific compatibility needs may choose to trust a certificate locally, subject to their own security assessment and policies. The company advises administrators to install the update on disconnected Windows systems and identify any certificates that depend on the removed roots, as they may need replacement.
Sources
- BleepingComputerMicrosoft releases Windows OOB updates to distrust eMudhra certificates
Continue chronologically
Related entity coverage
Related stories
Mozilla, Google, and Apple Block Weak eMudhra Certificates
Major tech vendors including Mozilla, Google, and Apple have blocked eight compromised eMudhra intermediate certificates featuring critically weak private keys.
Microsoft: Unsupported Windows Devices to Lose Security Updates
Microsoft warns that outdated Windows devices running unsupported versions will stop receiving security updates after upcoming certificate rotations.
How to Use Windows PC to Make and Receive Phone Calls
Learn how to use the Windows Phone Link app on your Windows 11 PC to seamlessly make and receive standard phone calls using your iPhone or Android device.
Most Windows Users Are Underusing Virtual Desktops
Discover how Windows virtual desktops can boost your multitasking and organization, offering more workspace on single or multiple monitors.
