Windows out-of-band updates address eMudhra certificate trust
News date: 2026-10-27 · Sources reviewed: 2026-10-28
Microsoft issued out-of-band updates for Windows devices that do not automatically refresh certificate trust lists.
Incident overview and confirmed facts
Microsoft released out-of-band updates on October 26 to remove trust in certificates linked to eMudhra after weak intermediate CA private keys were disclosed.
- The updates particularly matter for disconnected devices or systems without automatic CTL refresh.
- Avoid manual certificate removal without compatibility assessment.
Affected updates
Reporting identifies KB5134133 for Windows 11 24H2/25H2/26H2 and KB5134125 for Windows 10 21H2/22H2.
- Verify automatic certificate trust list updates.
- Assess isolated and specialized endpoints.
- Test applications that may depend on affected certificate chains.
Operational impact
Root and intermediate certificate trust is fundamental to TLS and code-signing security. Maintain centrally governed updates and documented exceptions.
- Include trust-list health in endpoint compliance checks.
- Follow Microsoft's official guidance.
Sources
Microsoft 365 environment review
Inventory Entra ID policies, user and application permissions, audit logs and exceptions. Pilot changes with a limited group, validate access impact and define a rollback path.
Implementation questions
Does this automatically affect our environment?
No. First verify whether the specific product, version and relevant configuration are deployed.
Is a security tool enough on its own?
No. Combine patching, restricted access, logging and tested backups.