---
title: Microsoft goes beyond blocking the leaked eMudhra intermediates: an out-of-band Windows update (Oct 26) and Edge (Oct 27) drop six eMudhra G3 roots and an AAA Certificate Services cross-sign from the trust list | ctxsec
url: https://ctxsec.com/items/microsoft-removes-emudhra-g3-roots-windows-edge-oob
description: ""
status: "official (Microsoft MSRC blog and KB release notes, Oct 26-27)"
published: 2026-10-27
---

> 

[← Cybersecurity News](/news) · [markdown](/items/microsoft-removes-emudhra-g3-roots-windows-edge-oob.md)

official (Microsoft MSRC blog and KB release notes, Oct 26-27)

2026-10-27

### Microsoft goes beyond blocking the leaked eMudhra intermediates: an out-of-band Windows update (Oct 26) and Edge (Oct 27) drop six eMudhra G3 roots and an AAA Certificate Services cross-sign from the trust list

After the [eMudhra intermediate key compromise](/items/go-cve-2026-111943-emudhra-intermediates-distrust) (eight intermediate CA keys, six for TLS and two for code signing), Microsoft had already added the eight intermediates to the Windows Disallowed Certificate Trust List on Oct 20 and pushed a CRLSet to Edge and WebView2. It has now made a broader trust decision:

- **Oct 26:** an out-of-band Windows update removes seven certificates from the Windows trust list: **six eMudhra G3 roots** and an **AAA Certificate Services cross-sign**. The updates (for example KB5134124 for Windows 10 1809 / Server 2019; BleepingComputer lists KB5134133 for Windows 11 24H2-26H2 and KB5134125 for Windows 10 21H2/22H2) are meant for machines that don't get automatic certificate trust list updates: disconnected networks, blocked update service, or auto-CTL turned off. Other machines get the change automatically.
- **Oct 27:** the same seven certificates were removed from the Microsoft Edge trust list.
- Microsoft is reviewing the remaining eMudhra roots and may make more changes later.

Microsoft warns that software which doesn't reliably check revocation or its disallowed list could still accept certificates from the compromised intermediates if someone re-trusts these roots locally, and advises against restoring trust without understanding that risk. **What to do:** make sure disconnected and CTL-disabled Windows systems get the OOB update, and find internal services, appliances and code-signing that chain to eMudhra G3 roots, since those certificates will need replacing.

Sources: [MSRC blog: Microsoft's response to compromised eMudhra certificate authority keys (updated Oct 27)](https://www.microsoft.com/en-us/msrc/blog/2026/10/microsoft-response-to-compromised-emudhra-certificate-authority-keys) · [Microsoft Support: October 26, 2026, KB5134124 (OS Build 17763.9378) out-of-band](https://support.microsoft.com/en-us/servicing/os/windows-10/2026/10/kb5134124-windows-10-1809-update) · [BleepingComputer: Microsoft releases Windows OOB updates to distrust eMudhra certificates](https://www.bleepingcomputer.com/news/microsoft/microsoft-releases-windows-oob-updates-to-distrust-emudhra-certificates/)