Microsoft issues Windows updates removing trust in eMudhra certificate roots

Microsoft released out-of-band Windows updates on October 26 to remove trust in seven certificates associated with compromised eMudhra certificate hierarchies, BleepingComputer reported. The updates protect disconnected systems and devices that cannot receive automatic certificate trust updates. The change removes six eMudhra G3 roots and an AAA Certificate Services cross-sign. It goes beyond Microsoft's earlier blocking of eight compromised intermediate authorities whose private keys could be recovered by testing just 256 possible numbers. KB5134133 covers Windows 11 versions 24H2, 25H2 and 26H2; KB5134125 covers Windows 10 versions 21H2 and 22H2. Administrators should identify dependent certificates that may need replacement. Organizations can still choose to trust certificates locally under their own policies.