What Happened: eMudhra Certificate Authority Compromise
An eMudhra Certificate Authority compromise is forcing an emergency distrust of eMudhra root and intermediate certificate authorities. Between October 17 and October 20, 2026, a security researcher showed that the private keys for eight eMudhra intermediate certificates were fundamentally broken because of an error in eMudhra's Key Generation Ceremony in April 2025. Anyone can brute-force those private keys in seconds.
Cisco has published an informational advisory calling for emergency distrust of the affected root and intermediate CAs. For an MSP, this means certificates issued by those authorities can no longer be trusted. Any client that relies on them is exposed to impersonation, man-in-the-middle attacks, and data interception. The cost shows up in emergency reissuance, trust store updates, and incident response. Your first move is to identify where the affected eMudhra certificates are trusted and remove that trust.
Trust is the foundation of encryption. When a CA's private key is public, the entire chain of trust collapses. For an MSP, this is not a theoretical risk. Every client that uses eMudhra-issued certificates or trusts those roots is now exposed to certificate forgery.
The severity is critical, though there is no evidence that this compromise has been exploited in the wild. That does not reduce the urgency. The private keys are public knowledge, so exploitation can happen at any time.
Timeline
- April 2025: eMudhra runs a Key Generation Ceremony that produces eight intermediate certificates with fundamentally broken private keys.
- Between October 17 and October 20, 2026: The compromise is uncovered. A security researcher demonstrates that the private keys can be brute-forced in seconds.
- October 28, 2026: Cisco publishes an informational advisory calling for emergency distrust of the affected eMudhra root and intermediate certificate authorities.
Who Is Affected
The affected parties are the eMudhra Root and Intermediate Certificate Authorities, specifically eight intermediate certificates. Cisco states that products not listed in its advisory are not affected.
For an MSP, the real exposure is in your clients' trust stores, certificate inventories, and anything that validates connections using eMudhra-issued certificates. This is an MSP-facing issue because most SMBs do not manage certificate trust directly. You do.
You are affected if any of your clients' servers, firewalls, VPNs, or applications have an eMudhra root or intermediate certificate in their trust store. You are also affected if any client uses a certificate issued by an eMudhra authority. Review Cisco's advisory for the specific products it has cleared.
Cisco's advisory is marked informational and will be updated as additional information becomes available. That means the list of affected and unaffected products can change. Check back before you finalize your response.
What This Means for Your Clients
When a certificate authority's private keys are broken, every certificate it issued becomes suspect. An attacker who recovers those keys can forge certificates for any domain, impersonate your clients' services, and decrypt or redirect traffic.
With eMudhra, the private keys for eight intermediate certificates are recoverable in seconds. That means any client using one of those certificates is exposed until the trust is removed and the certificate is replaced.
The business impact goes beyond the certificate itself. Attackers can impersonate a client's domain, intercept email, or redirect users to phishing sites. That leads to data loss, compliance breaches, and damaged client relationships. For an MSP, the financial hit comes from emergency response hours and potential liability.
Monitor your clients' domains and services for unexpected certificates. Certificate transparency logs can help you spot certificates that were issued for domains you manage. If you see a certificate from an eMudhra authority that you did not request, treat it as a sign of compromise.
Technical Details
CVE: None published. Product: eMudhra Root and Intermediate Certificate Authorities. Versions: Eight intermediate certificates; no specific versions provided. Attack vector: The private keys for eight eMudhra intermediate certificates were fundamentally broken due to an error in the Key Generation Ceremony (KGC) in April 2025. This allows anyone to brute-force acquire these private keys within seconds.
What MSPs Should Do
Act now. The longer an untrusted CA remains in your clients' trust stores, the longer they can be spoofed. Follow these steps.
- Distrust the affected eMudhra root and intermediate certificate authorities.
- Identify all trust stores and devices that include eMudhra root or intermediate certificates and remove or disable them.
- Inventory any certificates issued by eMudhra authorities and plan reissuance from a trusted CA.
- Check logs and monitoring for certificates that were presented during TLS handshakes and validate their issuer.
- Communicate with clients about any services that may be interrupted and set expectations for certificate replacement.
- After containment, review your certificate lifecycle management process so you can replace certificates quickly in the future.
How to Talk to Your Clients
Your clients will ask if they are safe. Be direct: if they use eMudhra-issued certificates or trust eMudhra roots, they are exposed. Tell them what you are doing to remove the trust and replace certificates.
Do not promise that everything is fine just because no exploit has been seen yet. The private keys are broken, so the risk is real. Give them a clear timeline for trust store updates and certificate reissuance.
If you use EnterProtect backup and recovery, you can tell them that you can restore systems to a clean state if an emergency rebuild is needed. That is a concrete promise you can keep.
How EnterProtect Helps
EnterProtect backup keeps clean, restorable copies of your clients' systems. If a compromised certificate forces you to rebuild a server or restore a device to a known good state, recovery gets a client running again.
EnterProtect vulnerability scanning finds exposed versions across your clients, so you know which systems need attention first.
Even if you do everything right, you may need to rebuild a system that has a compromised trust anchor. Clean backups give you a known good state to restore from. Vulnerability scanning gives you the visibility to know which systems need attention.
For an MSP, the goal is to limit downtime and get the client back to a known good state. EnterProtect's backup and vulnerability scanning are built for that.
Frequently Asked Questions
What Is the eMudhra Certificate Authority Compromise?
Between October 17 and October 20, 2026, a researcher showed that the private keys for eight eMudhra intermediate certificates were fundamentally broken due to an error in eMudhra's Key Generation Ceremony in April 2025. Anyone can brute-force those private keys in seconds. Cisco has called for emergency distrust of the affected root and intermediate CAs.
Which eMudhra Certificates Are Affected?
The affected products are the eMudhra Root and Intermediate Certificate Authorities, specifically eight intermediate certificates. Cisco's advisory states that products not listed in the advisory are not affected. No specific version numbers have been published.
How Do I Know If My Client Is Affected?
Check your clients' trust stores and certificate inventories for eMudhra root or intermediate certificates. Also review any TLS certificates issued by an eMudhra authority. If you find them, treat them as compromised and plan reissuance.
What Should I Do With eMudhra Root Certificates?
Follow Cisco's guidance and distrust the affected eMudhra root and intermediate certificate authorities. Remove or disable them from all trust stores. Then reissue any certificates that were signed by those authorities from a trusted CA.
Is There a CVE for This Vulnerability?
No CVE identifier has been published. Cisco released an informational advisory instead of a typical security advisory.
Sources
- Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities (Cisco Psirt)