eMudhra Intermediate Certificates Compromised
An attacker with access to the private key of any compromised intermediate certificates could impersonate any website or service
Summary
An attacker with access to the private key of any compromised intermediate certificates could impersonate any website or service
Threat details
Introduction
On 17 October 2026, an independent security researcher reported that the cryptographic keys associated with eight eMudhra Global TLS intermediate Certificate Authorities (CAs) were compromised.
In response, eMudhra revoked all affected intermediate CAs on 18 October 2026. eMudha states no certificates had been issued from the impacted intermediates, there is no evidence of infrastructure compromise, and no data breach has been reported.
Compromise Details
The compromised certificates were incorrectly generated due to a critical cryptographic defect during the certificate generation process, resulting in private keys generated with insufficient randomness, allowing potential attackers to:
- Recover the private keys associated with the compromised intermediate certificates.
- Issue fraudulent TLS certificates for domains and services.
- Conduct man-in-the-middle (MitM) attacks to intercept, decrypt, or manipulate encrypted communications.
- Hijack user sessions or credentials by leveraging trusted certificate chains
These certificates are widely trusted by browsers, and operating systems. Six of the eight compromised intermediate certificates, which were trusted by Chrome, Mozilla, and Apple could be used to issue TLS certificates. These certificates have now been blocked by the relevant vendors. The remaining two certificates, used for codesigning by Microsoft, have also been blocked. Potential impact remains for software, firmware, and devices where trust in the compromised certificates has not been removed.
eMudhra has not assigned a CVE identifier to this weak-key issue. Several vendors have tracked the flaw within their own products, including CVE-2026-91403 (Oracle Java), CVE-2026-111943 (Go), and CVE-2026-113470 (Firefox).
Remediation advice
Numerous browser vendors including Chrome, Mozilla, Apple, and, Microsoft have blocked the compromised certificates. Similarly, vendors such as Oracle, Go have released security updates for their products. Additionally, potential impact still exists in software, firmware, and devices that have not revoked trust of these certificates.
Affected organisations are encouraged to review the vendor advisories and apply the relevant updates as soon as possible. The NHS England National CSOC recommends impacted organisations to follow the remediation steps detailed below.
Remediation steps
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 23 October 2026 2:21 pm