Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities
Cisco has issued an emergency advisory regarding a critical security compromise involving eMudhra Certificate Authorities that could allow fraudulent TLS/HTTPS certificates to be issued.
Between October 17 and October 20, 2026, Cisco uncovered a critical security compromise involving Certificate Authorities managed by eMudhra. The vulnerability stems from a fundamental error in eMudhra's Key Generation Ceremony (KGC) in April 2025, which has rendered the private keys for eight eMudhra intermediate certificates fundamentally broken.
Critical Security Risk
The compromised certificates pose a severe threat as anyone possessing these weak private keys can now brute-force them within seconds and issue fraudulent TLS/HTTPS certificates for any domain on the internet. This vulnerability impacts any Cisco product that trusts these compromised eMudhra intermediate certificates, regardless of whether the trust is managed through Cisco's Trusted Root Store bundles, embedded certificates, or other third-party mechanisms.
This allows anyone to brute-force acquire these private keys within seconds.
Global Impact
Critically, all eight compromised certificates were cross-signed by Sectigo's AAA Certificate Services root in May 2025. This cross-signature ensured that the compromised keys were trusted by almost every device, browser, and operating system globally, even those that did not natively trust the eMudhra roots. The widespread trust amplifies the potential impact of this vulnerability across the internet.
Cisco's Response
Cisco's Product Security Incident Response Team (PSIRT) is actively investigating its product line to determine which devices and cloud services may be affected. The company has confirmed that certain products are not impacted and will provide updates as the investigation progresses. For affected products, Cisco will offer remediation steps, software fixes, or information about new releases.
Cisco has thanked eMudhra for reporting the issue and stated it is not currently aware of any malicious use of the vulnerability. The company is advising customers to regularly consult security advisories and ensure devices have sufficient memory before applying any software upgrades.
Customer Guidance
Customers affected by this vulnerability should contact the Cisco Technical Assistance Center (TAC) or their maintenance providers for assistance with software upgrades. When requesting upgrades, customers should have their product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.
Cisco emphasizes that this advisory is provided on an 'as is' basis without any express or implied guarantees. The company reserves the right to update or change the document at any time and advises customers to visit the Cisco Security Advisories page for the most recent information.
Related
