Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, aimed at systems that do not receive automatic certificate trust updates.

The KB5134133 update covers Windows 11 versions 24H2, 25H2, and 26H2, while KB5134125 covers Windows 10 versions 21H2 and 22H2. Both were released on October 26. Microsoft says the updates are intended for systems without internet access, devices that cannot reach its certificate-update service, and machines where automatic Certificate Trust List (CTL) updates have been disabled.

Root Cause: Weak Intermediate CA Keys

The emergency patches follow the discovery of eight eMudhra intermediate certificate authority private keys generated in April 2025 that were critically weak. Each key had a value smaller than 256, meaning an attacker could recover it by testing just 256 possible numbers almost instantly. Had they been exploited, the compromised keys could have let attackers forge certificates for legitimate websites and intercept encrypted traffic.

After the issue was disclosed, eMudhra revoked the eight compromised intermediate certificates. Mozilla, Google, Apple, and other software vendors followed by revoking them as well. Microsoft initially responded by updating the Windows Disallowed Certificate Trust List to block the eight affected intermediate CAs (six used for TLS, two for code signing), and shipped a CRLSet update for Microsoft Edge and WebView2 to block the affected TLS certificates without requiring a browser update.

Going Further: Removing Root Trust

The new OOB update goes beyond blocking the compromised intermediates. It removes seven certificates associated with the affected hierarchies from the Windows trust list entirely: six eMudhra G3 roots and an AAA Certificate Services cross-sign. Microsoft says the same seven certificates will be removed from the Edge trust list on October 27.

Microsoft notes that removing a root from a trust list is a distinct and broader action than revoking specific compromised intermediate keys. Organizations with a compatibility need can choose to locally trust a certificate, subject to their own security assessment.

Microsoft advises administrators to:

  • Install the OOB update on disconnected or air-gapped Windows systems
  • Identify any certificates that depend on the removed roots, as they may need to be replaced

Microsoft says it is continuing to investigate the remaining eMudhra roots and may make further trust changes as needed.