MWPRO IMPACT SCORE
OPERATIONAL IMPACT
74
0
25
50
75
100
HIGH IMPACT • REVIEW RECOMMENDED
Recommended Action:
Review the update and plan any required actions before rollout.
Review the update and plan any required actions before rollout.
What is MWPro Impact Score?
Watch our 60‑second explainer
Primary Audience
Tenant AdminsMicrosoft 365 AdminsSecurity TeamsCompliance TeamsIT ManagersAzure AdminsService Owners
Why this score?
AI Confidence
HIGH
Enough detail is available to trust this assessment.
Assessment Reasoning
Microsoft is actively deploying Windows and Edge trust list updates to block compromised eMudhra CAs. Admins must verify certificate dependencies, update disconnected or isolated devices, and deploy replacement certificates where necessary. The rollout is active and security-related, creating high urgency and considerable admin effort but limited direct user disruption.
85
Admin Impact
30
User Impact
90
Urgency
70
Effort
WHAT YOU NEED TO KNOW
AT A GLANCE
Microsoft is blocking eight compromised eMudhra certificate authority keys. Updates to Windows and Edge will remove affected certificates from trust lists.
END USERS
No major end-user change expected.
IT ADMINS
Ensure Windows and Edge updates are applied and review any devices or Azure VMs that do not receive automatic updates.
ROLLOUT TIMELINE
Rolling out:
Late October 2026
Late October 2026
📢 Official Microsoft Message Center Announcement
Microsoft Windows: Updates to address compromised eMudhra certificate authority keys
Message ID: MC1529467
[What and why]
Microsoft is responding to an issue involving eight eMudhra intermediate certificate authority (CA) private keys, six associated with TLS and two with code signing. Because these keys could be recovered, they could potentially be used to create certificates or sign content that appeared to come from a trusted CA. The issue arose in eMudhra’s certificate hierarchy and was not a compromise of Microsoft systems.
Microsoft is updating certificate trust to block affected certificate authorities and remove certificates associated with the affected hierarchies.
[Rollout schedule]
- General Availability (Worldwide, GCC, GCC High, DoD): Beginning in late October 2026 and expected to complete by late October 2026
[Impact on your organization]
Who is affected
- Organizations using Windows, Microsoft Edge, or WebView2, particularly organizations with certificates that chain to one of the eight certificates being removed
- Organizations managing disconnected Windows devices or disconnected Azure devices may need to take additional action
Platforms and services
- Windows
- Microsoft Edge
- WebView2
- Azure virtual machines
What will happen
- Microsoft has published an update to the Windows Disallowed Certificate Trust List to block the affected certificate authorities.
- Microsoft has deployed a separate CRLSet update for Microsoft Edge and WebView2 to block affected TLS certificates signed by the affected certificate authorities.
- The Microsoft Edge and WebView2 update is delivered automatically through the component update mechanism. Customers do not need to install a new browser version.
- Microsoft has released updates to Windows and Microsoft Edge to remove certificates associated with the affected hierarchies from their trust lists.
- After these updates reach a device, the affected certificates will no longer be trusted by default through the respective trust lists.
[Action required and recommendations]
- Keep updates flowing. Allow automatic Windows certificate trust updates and Microsoft Edge component updates to reach your devices.
- Check disconnected Windows devices. If you manage Windows devices that do not receive automatic updates, make sure your update process delivers the updated Disallowed Certificate Trust List and upcoming trust-list changes. See the Microsoft Learn guidance in Learn more for information about distributing certificate trust lists in disconnected environments.
- Review disconnected Azure devices. Review disconnected Azure devices running on Virtual Machine Scale Sets (VMSS) or single-instance VMs. Updated images are available in Azure Marketplace, and customers can deploy them to protect against this vulnerability.
- Replace dependent certificates. If any of your certificates chain to one of the seven certificates being removed, identify those dependencies and obtain replacement certificates or an alternative trusted chain before the changes reach your devices.
Learn more
- Microsoft’s response to compromised eMudhra certificate authority keys
- Configure trusted roots and disallowed certificates in Windows | Microsoft Learn
[Compliance considerations]
No compliance considerations identified. Review as appropriate for your organization.
Source: Microsoft Message Center • Analysed by MWPro
