cisco-sa-emudhra-info-ScS22A1r: Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities

Published Oct 23, 2026

Updated

Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered.A security researcher demonstrated that the private keys for eight eMudhra intermediate certificates were fundamentally broken due to an unprecedented error in their Key Generation Ceremony (KGC) in April 2025. This allows anyone to brute-force acquire these private keys within seconds. For more information, see eMudhra Intermediate CA Compromise and the Cisco Talos blog post Compromised eMudhra intermediate certificates.Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability.This advisory will be updated as additional information becomes available.This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1r

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
Emergency-distrust the eMudhra root and intermediate Certificate Authorities, including the eight compromised eMudhra intermediate certificates.

Event History

Oct 23, 2026

Advisory Published

via Cisco·04:00 PM

Data Sourced

via Cisco·04:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which Cisco products should be treated as affected?

Only products listed in the advisory should be treated as affected. Cisco states that products not listed there are not affected based on its review.

What capability does an attacker need to exploit the certificate issue?

The compromised intermediate certificate private keys can reportedly be brute-forced within seconds. The advisory states that anyone can acquire these keys because of the key-generation error.

Is remediation guidance available in the advisory?

The provided advisory information does not include product-specific remediation or workaround instructions. Cisco states that the advisory will be updated as additional information becomes available.

cisco-sa-emudhra-info-ScS22A1r: Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities

Remediation

Event History

Frequently Asked Questions

Which Cisco products should be treated as affected?

What capability does an attacker need to exploit the certificate issue?

Is remediation guidance available in the advisory?

Company

Resources

Contact

Frequently Asked Questions

Which Cisco products should be treated as affected?

What capability does an attacker need to exploit the certificate issue?

Is remediation guidance available in the advisory?