Microsoft issues Windows update for eMudhra certificate cleanup

Microsoft released an out-of-band update for Windows that focuses on certificate updates rather than emergency security fixes. The release applies to supported operating systems ranging from Windows 11 and Windows Server 2025 to Windows 10. It is intended for devices that cannot access Microsoft's certificate-update service or where automatic CTL updates are disabled. The update contains everything included in the October 13 update, including ongoing VPN issues and changes that could break on-premises Exchange Servers. Known issues with Smart App Control, audio, and Remote Desktop connections for non-admin users from the October 13 update are not resolved in this patch.

The out-of-band update was released following Microsoft's response to the compromised eMudhra certificate keys. The Indian certification authority eMudhra had its private keys compromised earlier in the month, requiring a massive cleanup effort. Microsoft stated that the compromised eMudhra keys could potentially be used to create certificates or sign content appearing to come from a trusted CA. Microsoft updated its Windows Disallowed Certificate Trust List to block the affected eMudhra certificates. A separate CRLSet release was issued for Edge and WebView2 regarding the compromised certificates. On October 26, Microsoft released an out-of-band Windows update removing seven certificates associated with the affected hierarchies.

Microsoft's out-of-band patches are typically released after the company breaks a product and needs to issue an emergency fix. The current revision is due to the compromised eMudhra certificates and a need to update CTLs on disconnected devices. Microsoft released out-of-band Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys.