CISCO: 🧾 Reference: Cisco Security Advisory — Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities

CISCO Security Advisory

Published Date: Not specified

Advisory Summary

🗓️ Oct 26, 2026

🔔 Emergency CA Distrust Advisory (Informational): eMudhra Root/Intermediate Certificates

⚠️ What happened
Between Oct 17–20, 2026, Cisco Talos identified a CA infrastructure compromise affecting certificate authorities managed by eMudhra. A researcher demonstrated that private keys for eight eMudhra intermediate certificates were fundamentally broken due to an unprecedented error during the Key Generation Ceremony (KGC) in April 2025—enabling attackers to brute-force retrieve the private keys in seconds.

• Mint fraudulent certificates that chain to trusted intermediates
• Perform traffic interception where trust chains include affected eMudhra intermediates
• Undermine TLS/PKI trust assumptions across systems that rely on those intermediates

• If your product is not listed in the advisory, Cisco indicates it is not affected.
• Treat this as trust/PKI hygiene risk, not a traditional “software vulnerability” issue—focus on certificate chain trust, validation paths, and product trust store behavior.

• Review whether your Cisco products / security appliances / network devices are included in the advisory’s affected list.
• If affected, prioritize:
• Immediate trust-store / certificate validation review
• Ensuring any mitigations or updates Cisco recommends are applied promptly
• Monitoring for abnormal TLS issuance/interception patterns in your environment
• Coordinate with IAM/PKI owners: determine which systems trust eMudhra chains and whether revocation/validation controls (OCSP/CRL behavior) meet your threat model.

Reference: Vendor Advisory