Windows and eMudhra: disconnected PCs also need the new trust lists
Microsoft removes seven certificates from its trust lists. Two Windows updates target devices missing automatic certificate-list updates; hotpatch also needs attention.
Going deeper
Generated image · SecuFocus
At a glance
Key points
A Windows PC that cannot receive certificate updates may miss the eMudhra protections. Microsoft’s KB5134133 for Windows 11 and KB5134125 for Windows 10 target these devices in particular. If you manage one, have its trust lists and version-specific update process checked, not just its browser version.
Eight intermediate keys, then seven certificates removed
MSRC’s October 26 response describes eight recoverable eMudhra intermediate-CA private keys: six associated with TLS and two with code signing. They could be used to create certificates or sign content that appeared to come from a trusted authority. Microsoft says the issue arose in eMudhra’s hierarchy, not from a compromise of Microsoft systems.
Blocking compromised intermediates and removing trusted roots are separate decisions. Microsoft published a Windows Disallowed Certificate Trust List update on October 20. The October 26 out-of-band update then removes seven certificates from the trust list: six eMudhra G3 roots and an AAA Certificate Services cross-sign. Those seven certificates are not the eight intermediate keys.
These packages target devices missing certificate-list updates
Both KBs target devices that do not receive current trust lists: disconnected machines, devices unable to reach the certificate-update service, or systems with automatic list updates disabled. For connected devices, Microsoft says to keep Windows trust updates and Edge component updates flowing. Installing a new browser version alone does not establish that every system trust list has changed.
These cumulative updates are dated October 26. Use the bulletin for your version and edition to check prerequisites and delivery channels. Windows 10 22H2 is presented under ESU: this table does not grant update entitlement to an ineligible installation.
| System | Update |
|---|---|
| Windows 11 24H2, 25H2, 26H2 | KB5134133 |
| Windows 10 21H2, 22H2 | KB5134125 |
Check maintenance implications before installing
The October 27 revision of KB5134133 adds an important caveat: a hotpatch-enrolled device that installs this package will not receive hotpatch updates until after installing the January 2027 baseline. Include that effect in the maintenance plan. It does not mean the device should stop receiving all other updates.
For offline Windows image servicing, the KBs also require the boot.stl file matching the image’s version and architecture; omitting it can prevent installation media from booting. Have the image maintainer follow the bulletin rather than copying a file from another Windows version.
After the change, have the received update, the trust lists actually delivered and services depending on the removed certificates checked. SecuFocus has read Microsoft’s documents; we have not installed these packages or tested a Windows image.
Replace a dependent chain rather than bypassing a warning
If your website or internal service chains to one of the seven removed certificates, Microsoft says to identify that dependency and obtain replacement certificates or an alternative trusted chain. Reinstalling a root locally just to clear an error restores trust the vendor has removed; that requires a security assessment.
Edge and WebView2 block the affected TLS intermediates through a CRLSet component update, without requiring a new browser version. MSRC separately schedules removal of the seven certificates from Edge’s trust list for October 27. That announced date is not a verification that every device has received it. Firefox and Thunderbird use their own updates.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.