Summary
Microsoft is updating Windows, Edge, and WebView2 to block eight compromised eMudhra certificate authority keys by late October 2026. Organizations must allow automatic updates, manage disconnected devices, and replace certificates chaining to these keys to maintain trust and security.
Message ID: MC1529467
Published: Oct 28, 2026
Service: Microsoft 365 suite
Tag: User impact, Admin impact
Microsoft Message
Microsoft is responding to an issue involving eight eMudhra intermediate certificate authority (CA) private keys, six associated with TLS and two with code signing. Because these keys could be recovered, they could potentially be used to create certificates or sign content that appeared to come from a trusted CA. The issue arose in eMudhra’s certificate hierarchy and was not a compromise of Microsoft systems.
Microsoft is updating certificate trust to block affected certificate authorities and remove certificates associated with the affected hierarchies.
Rollout schedule
General Availability (Worldwide, GCC, GCC High, DoD): Beginning in late October 2026 and expected to complete by late October 2026
Impact on your organization
Who is affected
- Organizations using Windows, Microsoft Edge, or WebView2, particularly organizations with certificates that chain to one of the eight certificates being removed
- Organizations managing disconnected Windows devices or disconnected Azure devices may need to take additional action
Platforms and services
- Windows
- Microsoft Edge
- WebView2
- Azure virtual machines
What will happen
- Microsoft has published an update to the Windows Disallowed Certificate Trust List to block the affected certificate authorities.
- Microsoft has deployed a separate CRLSet update for Microsoft Edge and WebView2 to block affected TLS certificates signed by the affected certificate authorities.
- The Microsoft Edge and WebView2 update is delivered automatically through the component update mechanism. Customers do not need to install a new browser version.
- Microsoft has released updates to Windows and Microsoft Edge to remove certificates associated with the affected hierarchies from their trust lists.
- After these updates reach a device, the affected certificates will no longer be trusted by default through the respective trust lists.
Action required and recommendations
Keep updates flowing. Allow automatic Windows certificate trust updates and Microsoft Edge component updates to reach your devices.
- Check disconnected Windows devices. If you manage Windows devices that do not receive automatic updates, make sure your update process delivers the updated Disallowed Certificate Trust List and upcoming trust-list changes. See the Microsoft Learn guidance in Learn more for information about distributing certificate trust lists in disconnected environments.
- Review disconnected Azure devices. Review disconnected Azure devices running on Virtual Machine Scale Sets (VMSS) or single-instance VMs. Updated images are available in Azure Marketplace, and customers can deploy them to protect against this vulnerability.
- Replace dependent certificates. If any of your certificates chain to one of the seven certificates being removed, identify those dependencies and obtain replacement certificates or an alternative trusted chain before the changes reach your devices.
Learn more
- Microsoft’s response to compromised eMudhra certificate authority keys
- Configure trusted roots and disallowed certificates in Windows | Microsoft Learn
Compliance considerations
No compliance considerations identified. Review as appropriate for your organization.