KB5134133: Windows 11 update removes 7 eMudhra certificates, manual download only

Microsoft released KB5134133, an out-of-band Windows 11 update, on 26 October 2026. It removes seven certificates from Windows' list of trusted roots after the private keys of eight eMudhra intermediate certificate authorities turned out to be trivially recoverable. Most PCs will receive the same protection through Microsoft's automatic certificate-list updates and need to do nothing. The KB exists for machines that don't: air-gapped networks, devices that can't reach Microsoft's update service, and PCs where automatic root updates are switched off. For those, it is a manual download.

Key points

• KB5134133 is a non-security, out-of-band cumulative update for Windows 11 24H2, 25H2 and 26H2, released 26 October 2026 (builds 26100.9725, 26200.9725 and 26300.9725), according to Microsoft's support page.
• Microsoft says it removes seven certificates from the Windows trust list: six eMudhra G3 roots and one AAA Certificate Services cross-sign.
• The Microsoft page lists Windows Update, Windows Update for Business and WSUS as "not available" for this update; the Microsoft Update Catalog is the channel.
• It carries the 13 October update (KB5127648) and its known issues, including Smart App Control and Remote Desktop problems.
• Microsoft had already blocked the compromised intermediates on 20 October through the Disallowed Certificate Trust List; this update is the broader, second step.

What to do

Do you need it? If your Windows PCs get certificate updates automatically (the default for any machine that can reach Windows Update), probably not. Microsoft's guidance is to keep automatic trust-list updates and Edge component updates flowing. Install KB5134133 if your devices are disconnected, behind a network that blocks Microsoft's certificate-update service, or have automatic root updates turned off.

How to get it. Search the Microsoft Update Catalog for KB5134133 and download the x64 or Arm64 package. Microsoft's page says 24H2 and 25H2 machines must first have a Windows update from 10 June 2025 or later (for example KB5060842) and the latest servicing stack update. The update uses a checkpoint: KB5043080 must go on before it. You can install both .msu files in order by double-clicking them or with wusa.exe, or put every .msu in one folder and run DISM /Online /Add-Package /PackagePath:<path to the KB5134133 .msu> from an elevated Command Prompt; DISM installs the checkpoint itself.

Before you deploy. Find anything on your network whose certificate chains to the seven removed certificates (internal sites, code-signed software, partner services) and arrange replacements from another certificate authority first. Microsoft advises that anyone who must keep trusting one of these certificates should do so only after their own security assessment, and not restore trust in an affected hierarchy without understanding the risk.

Other platforms. This KB covers Windows 11. The Register says the release spans supported systems "down to Windows 10", but Microsoft's KB5134133 page covers only Windows 11 24H2, 25H2 and 26H2, and we could not confirm KB numbers for Windows 10 or Windows Server from the sources we read. Check Microsoft's release health pages for your version.

What happened

On Saturday 17 October 2026 a researcher told browser makers that the private keys behind eight intermediate certificates issued by eMudhra, an Indian certificate authority, could be computed from the public certificates. Mozilla received the report at 20:06 UTC, according to The Register. Scott Helme, who analysed the certificates, found that one key was simply the number 4, and others were 56 and 115.

Browsers moved within hours. The Hacker News's account of the timeline says Chrome had a CRLSet block live by 19:45 UTC on 17 October and Mozilla completed its OneCRL block at 22:59 UTC. Apple followed on 19 October. On 20 October Microsoft updated the Windows Disallowed Certificate Trust List to block the affected certificates and shipped a CRLSet update to Edge and WebView2, which arrives through the component-update mechanism and needs no new browser version.

Microsoft's own post describes the problem as eight compromised keys, six for TLS and two for code signing, and says the issue lay in eMudhra's certificate hierarchy and "was not a compromise of Microsoft systems."

The 26 October update is the next step. Microsoft says it removes six eMudhra G3 roots and an AAA Certificate Services cross-sign from the Windows trust list, and that it planned to remove the same seven certificates from Edge's trust list on Tuesday 27 October. The post distinguishes this from the 20 October blocks: the blocks address the identified compromised intermediates, while removing roots is a separate and broader decision. Microsoft says it is still evaluating the remaining eMudhra roots.

Background

Operating systems and browsers decide which certificate authorities (CAs) to trust through root stores. A root signs intermediates, and intermediates sign the certificates websites and software use. Whoever holds an intermediate's private key can mint certificates for any domain that clients will accept. That is why Mozilla said the keys could let attackers issue fraudulent HTTPS certificates for sites they don't control, and why Cloudflare warned of forged certificates for any domain.

The Hacker News traces the flaw to a key ceremony on 30 April 2025, and reports that eMudhra put out a press release on 21 October attributing the problem to that ceremony. India's CERT-In and Red Hat have published advisories, and fixes have shipped in Go, Node.js, Firefox, NSS, Debian, Ubuntu and Python's certifi. We covered the browser response in our earlier report on the eight intermediates and the Java side in our Java fix guide.

How the Windows layers fit together

Windows handles the problem in three layers, and it helps to know which one a given machine has.

1. Disallowed Certificate Trust List (20 October). Blocks the specific compromised intermediates. Delivered through Windows' automatic certificate-update mechanism. Machines that can't reach it don't get it unless they install an update that carries it.
2. Edge and WebView2 CRLSet (20 October). Blocks the affected TLS certificates in Microsoft's browser engine, through component updates.
3. Trust-list removal of seven certificates (26 October for Windows, planned 27 October for Edge). Removes the roots themselves, so chains through them no longer validate at all.

KB5134133 is aimed at layer 3 for devices that don't receive automatic trust-list updates. Microsoft's support page says it contains an updated trusted-root payload but does not list the specific certificates; the list of seven comes from Microsoft's security blog post. It also bundles Copilot+ PC components (Image Search, Content Extraction, Semantic Analysis and Settings Model, version 1.2608.951.0) and servicing stack update KB5127647 (build 26100.9703), so it is not a certificate-only patch.

What it means

For administrators of connected fleets, the lesson is the usual one: leave automatic root updates on. For the disconnected minority (industrial networks, labs, government enclaves, some VM images), a trust-list change is only as fast as your own patch pipeline. Microsoft points Azure users with disconnected virtual machine scale sets or single-instance VMs to updated images in the Azure Marketplace.

The bigger risk is breakage from the removal itself. Anything chaining to the removed roots will stop validating once the change reaches a device. The Hacker News reports that sites with certificates under emSign ECC Root CA - G3 needed replacements before Chrome's removal on 27 October, and that Mozilla warns some servers will become unreachable for other users of NSS-based trust lists. Non-browser software is the quiet exposure: revocation checks generally don't apply to command-line tools and libraries, so those keep trusting the chain until their bundle changes.

What we don't know yet

• Which certificates exactly. Microsoft's KB page does not list them; its security blog post gives only the description "six eMudhra G3 roots and an AAA Certificate Services cross-sign", without names or thumbprints.
• Exploitation. The Hacker News says no confirmed exploitation has been reported, with the caveat that the only available detection route is Certificate Transparency logs, which cover only logged certificates.
• Other Windows versions. See above: we could not confirm KB numbers for Windows 10 or Windows Server.
• eMudhra's side. The Register said on 20 October that eMudhra had not answered its questions; the company later issued a press release, per The Hacker News, which we have not read in full.
• Further removals. Microsoft says it is still evaluating the remaining eMudhra roots.

Known issues you inherit

Because KB5134133 includes the 13 October update, Microsoft's page lists these open problems. Smart App Control may not switch on after having been disabled, and the setting can be greyed out; Microsoft documents registry and Group Policy workarounds and says a fix is coming. Non-admin users may fail to connect by Remote Desktop with error 0xC000000D to hosts with Administrator protection enabled; the suggested mitigation is temporarily turning that protection off, and Microsoft is working on a fix. Some USB Audio Class 1.0 devices fail to start or play no sound after the 8 September update (KB5124012); an earlier out-of-band update, KB5129195, fixed the 8-channel and 3D audio cases but other symptoms remain open. The Register also notes ongoing Always On VPN problems and a change that could break on-premises Exchange, carried over from the October update. Weigh those against the certificate risk before rolling it out widely.

When updating Windows installation media with dynamic updates, Microsoft says to include the boot.stl file from the device's Windows\Boot\EFI folder; without it, setup can fail with error 0xc0430001.

What to watch next

• Microsoft's Edge trust-list removal, planned for 27 October.
• Whether Microsoft publishes the specific certificate names and thumbprints, and any decision on the remaining eMudhra roots.
• Whether Windows Update, WSUS and the Update Catalog all carry the trust-list change in the November Patch Tuesday release.
• Fixes for the Smart App Control, Remote Desktop and USB audio issues.
• eMudhra's remediation and the Indian government's investigation, which The Hacker News says has been opened.

Sources

• Microsoft: KB5134133 (Windows 11 24H2, 25H2, 26H2), 26 October 2026
• Microsoft Security Response Center: response to compromised eMudhra CA keys
• The Register: Microsoft releases out-of-band Windows fixes with certificate updates
• The Register: eMudhra's private keys compromised, one of them was the number 4
• The Hacker News: eight eMudhra CA keys compromised