eMudhra Windows update: which machines need it

The change goes further than last week's block of the eight leaked intermediates. Most machines get it automatically; disconnected ones, and anything that keeps its own trust store, do not.

Microsoft has stopped trusting eMudhra's G3 root certificates in Windows. Out-of-band updates released on October 26 take seven certificates out of the set of roots Windows trusts: six eMudhra G3 roots, plus one AAA Certificate Services cross-sign. Edge was due to drop the same seven on October 27, Microsoft said.

This goes further than Microsoft's first move. On October 20 it put the eight eMudhra intermediates whose private keys had leaked, six used for TLS and two for signing code, on the Windows Disallowed Certificate Trust List. That stopped the bad keys. Removing the roots also stops Windows trusting legitimate certificates that eMudhra issued under them, a wider step than blocking the leaked intermediates, as Microsoft itself describes it. Any internal service or partner endpoint still using a certificate from those hierarchies can fail TLS checks on Windows once the change lands. Our October 22 story covers how the keys were found and what it means for Indian DSC and eSign users.

Who needs the KB

Most Windows machines do not. Trust list changes reach connected devices through Windows' automatic certificate updates, as The Register points out. The out-of-band packages are for systems with no internet access, devices that cannot reach Microsoft's certificate update service, and machines where automatic trust list updates are switched off, which Veeam's support note says can be set by Group Policy.

The Microsoft 365 message center post MC1526780 lists one package per version, all in the Microsoft Update Catalog:

Windows Server 2016: KB5134123
Windows Server 2019, and Windows 10 Enterprise LTSC 2019: KB5134124
Windows Server 2022: KB5134140
Windows Server 2025: KB5134137
Windows 10 Enterprise LTSC 2021, and Windows 10 22H2: KB5134125
Windows 11 23H2: KB5134130
Windows 11 24H2, 25H2 and 26H2: KB5134133
Windows 11 26H1: KB5134134

There is a catch. The Register reports that these are non-security releases that include everything in the October 13 update, so the known issues from that month come with them: trouble with VPNs, Always On VPN among them, an Exchange Server change that can break on-premises installs, plus Smart App Control, audio and Remote Desktop problems for non-admin users. The Register says the patch does not fix them, so weigh them before installing on a server that skipped October 13. Veeam's support note, written on October 21, describes a manual import of the Disallowed list for offline servers, but that covers only the October 20 block of the intermediates, not the root removal.

Microsoft also flags disconnected Azure machines on Virtual Machine Scale Sets or single VMs, and says updated images are in Azure Marketplace. Azure App Service for Windows finished its own rollout by October 25.

What Windows does not cover

The update changes the Windows store only. The Azure App Service post lists what it does not reach: certificates bundled with an application, runtime or dependency, and custom container images. Appliances with their own trust store need the vendor's update; Veeam, for one, tells customers to update its appliances through Veeam Updater rather than edit their trust store by hand. A post on the Azure App Service blog by Byron Tardif warns that patching the operating system's certificate store does not prove each TLS client inside an app is safe.

Microsoft is still reviewing eMudhra's other roots and says further trust changes will follow as affected customers move off them. It allows a company to trust a certificate locally if it has a specific compatibility need, but only after its own security review.

What IT teams should do

On connected servers, confirm at least the October 20 block arrived. Veeam's check: the disallowed trust list's last sync time should be October 20, 2026 or later. No source we read gives a matching check for the root removal.
List machines with automatic root certificate updates disabled by Group Policy, and air-gapped systems. Install the KB for each version after weighing the October 13 known issues; the manual Disallowed import covers only the intermediates.
Microsoft asks owners to find certificates that chain to any of the seven removed certificates: eMudhra's six emSign G3 roots, or the path through the AAA Certificate Services cross-sign. Replace them from another CA before partners' Windows machines stop trusting them.
Rebuild custom container images and update application trust bundles; the Windows update does not reach them.
Do not re-add the roots as a quick fix for TLS errors. If one system truly needs it, record the risk review Microsoft asks for.

Windows drops 6 eMudhra roots: which PCs and servers need the KB

Who needs the KB

What Windows does not cover

What IT teams should do

Sources