Microsoft Rushes Out Windows Certificate Fixes After a Certificate Authority Compromise

Microsoft's Out-of-Band Windows Certificate Update, Explained

Microsoft released an out-of-band Windows certificate update on October 26, 2026, removing seven certificates associated with eMudhra certificate hierarchies from the Windows trust list. The reason, in Microsoft's words, is that the certificates could potentially be used to create certificates or sign content that appeared to come from a trusted certificate authority. The affected items are six eMudhra G3 roots and an AAA Certificate Services cross-sign, removed after the private keys of intermediate certificate authorities were compromised.

Out-of-band updates are unusual, and that is the point. Microsoft normally ships fixes on Patch Tuesday, and an update outside that cycle signals something that could not wait. In this case the urgency is about trust itself. Certificate authorities are the organisations whose signatures tell your computer that a website, a piece of software or a signed document is genuinely what it claims to be. If an attacker holds a compromised intermediate CA key, they can mint certificates that Windows would trust, which is about as serious as trust failures get.

Which Updates, and Who Needs Them

Microsoft released KB5134130 for Windows 11 23H2, KB5134133 for Windows 11 26H2, 25H2 and 24H2, and KB5134134 for Windows 11 26H1, with a similar out-of-band update for Windows 10 under KB5134125. The packages are cumulative, non-security updates that include improvements from previous releases plus updated certificate trust information, and they update the list of untrusted certificates.

Here is the part most people can skip worrying about: devices that receive certificate updates normally do not need to install these packages manually. Microsoft's normal certificate trust list updates already reach connected devices through the usual service. The out-of-band packages exist for devices that cannot receive those updates normally: machines in disconnected environments, systems where automatic certificate trust list updates are disabled, and computers that cannot access Microsoft's certificate-update service. If your Windows PC is online and updating normally, you are almost certainly already covered.

Why Certificate Trust Lists Matter to Regular Users

You never see a certificate trust list, but you rely on it dozens of times a day. Every time your browser shows a padlock, every time Windows verifies a driver or an app installer, every time your email client checks a signed message, the system consults its list of trusted roots. Removing a compromised root is like a bank cancelling a stolen master key: it stops the key from opening anything new, even if nobody has yet proven it was used.

Microsoft also updated its Windows Disallowed Certificate Trust List to block the affected certificates, with a separate CRLSet release for Edge and WebView2. The release notes list known issues involving Smart App Control, Remote Desktop connections and some USB audio devices, so administrators rolling these packages out to disconnected machines should read the notes before deploying widely. For home users, the practical advice is simpler: leave automatic updates on, and do not disable certificate trust list updates unless you have a specific reason and understand the trade-off.

The Bigger Picture: Someone Else's Problem, Your Risk

Microsoft's own framing is refreshingly honest: this time the problem was somebody else's, and the fix is about getting a trust list update out to devices that are disconnected from normal trust list updates. Certificate authorities sit at the foundation of internet security, and when one is compromised, the blast radius is every device that trusts it. That is why the response is a trust list change, not a patch for a single product.

The incident is also a reminder that the certificate system depends on a small number of organisations doing their jobs perfectly, forever. Compromised intermediate keys are rare, but they are not theoretical, and the industry's response playbook, revoke, distrust, push updated lists, exists precisely for weeks like this one. The system worked here: the compromise was detected, the certificates were removed, and the updates went out.

What to Do

If you manage Windows machines, check whether any of your fleet sits in a disconnected environment or has certificate trust list updates disabled. Those are the machines these packages are for, and they need the update through the Microsoft Update Catalog. If you are a home user with a normal, online PC, just confirm Windows Update is on and let it do its job. And if you have ever been tempted to turn off automatic updates to avoid reboots, this is a good week to reconsider: the quiet, boring updates are the ones that keep the trust system working. For the regular monthly cycle, see our coverage of the October Patch Tuesday update, and for the wider update season, see the iOS 27.2 release and its 160-plus security fixes.