Microsoft ships an out-of-band Windows patch: purges eMudhra certificates

⚡ The gist in 5 seconds

• Microsoft released an out-of-band update for Windows — not an urgent bug fix, but an update to the trusted certificate list (CTL).
• It targets Windows 11, Windows Server 2025 and Windows 10: machines that can't reach Microsoft's certificate service or have auto-updating of the list disabled.
• It bundles everything from the October 13 patch — along with its known bugs: VPN, Smart App Control, audio, and RDP for non-admins. None of those were fixed.

🔍 What happened

On October 26, Microsoft shipped an out-of-band update that removes seven certificates from Windows' trusted list: six eMudhra G3 roots and a cross-sign for AAA Certificate Services. The reason is the compromise of private keys at the Indian certificate authority eMudhra, which happened earlier in October.

The CTL itself is the list Windows uses to decide whether to trust a certificate. Normally it's pulled over the network via Microsoft's service. If a machine is in an isolated environment or auto-updating of the list is disabled, it stays with the old set of roots. In that case, an app or website may fail certificate validation — not because it's broken, but because the system still trusts someone who can no longer be trusted. Separately, Microsoft released a CRLSet for Edge and WebView2.

There's a second layer too. The patch includes everything from the October 13 update, and that one has plenty of known issues: VPN problems, a change that could take down on-premises Exchange Server, Smart App Control issues, audio problems, and Remote Desktop issues for users without admin rights. None of these were fixed in this release — Microsoft explicitly warns to factor that in before installing.

🧠 Our take

Usually an out-of-band patch means "we broke something ourselves and it's on fire." This is different: the breakage wasn't in Redmond, but at someone else's certificate authority. Our assessment — this is a rare case of Microsoft spending an out-of-band release on someone else's incident rather than its own. And it makes sense: certificate trust is the foundation everything rests on, from banking apps to corporate VPNs.

For an admin, the question isn't "install or not," but "is it even needed." Most home and office machines get the CTL automatically and won't notice this package. But an isolated test bench, a factory terminal, or a machine with list auto-updating turned off is exactly the target audience. We think that's where it should be installed — with a caveat: first check whether you're running Exchange or a VPN client from the list of affected items.

Who wins? The Indian CA has already lost — its roots were dropped from Windows' trust, and that's a long and expensive road back. Users gain in security and lose in stability, because the certificates came bundled with someone else's bugs. A mediocre trade-off, but the alternative is worse: leaving keys in the trust store that someone has already compromised.

⚠️ What we don't know

The text contains no KB numbers, no build numbers, and no full list of affected hierarchies — only a count: six eMudhra G3 roots plus one AAA cross-sign. There's also no estimate of how many devices actually lack access to the CTL service. The piece at The Register relies on a Microsoft quote, but the actual support documents aren't in the source. Before installing, check the Microsoft Update Catalog and the known-issues section — that's the only reliable way to know whether this applies to you.

Prediction: within the quarter, Microsoft will ship a separate fix for the VPN and Exchange change from the October 13 patch — otherwise enterprise admins will simply stop installing updates in batches.

Source: The Register