Cisco eMudhra Emergency Distrust: What to Patch Now

Cisco is telling customers to distrust eMudhra root and intermediate certificate authorities (CAs). A researcher showed that the private keys for eight eMudhra intermediate certificates can be brute-forced within seconds. Cisco's advisory (version 1.7, last updated November 5, 2026) lists which products need action, and some fixes are still months away.

What happened

Between October 17 and October 20, 2026, a critical compromise involving CAs managed by eMudhra was uncovered. The cause was an error in the Key Generation Ceremony (KGC) in April 2025. Cisco calls it "unprecedented" and says the eight intermediate keys were "fundamentally broken."

In practice, anyone who recovers an intermediate CA key can sign certificates that chain to a CA your systems may trust. That is why Cisco chose an emergency distrust instead of waiting for a normal rotation.

Cisco first published the advisory on October 23, 2026. Cisco also points to the Talos post "Compromised eMudhra intermediate certificates" and a separate Splunk page for Splunk products. All details below come from the Cisco advisory.

Which Cisco products are affected and what fixes exist

Cisco says a product not listed in the advisory is not affected. The list is still growing, so recheck it.

Products with a software fix and target date

Until ASDM 11.0.32.1 ships, administrators can use the ASDM Upgrade Wizard to add endpoint certificates. Duo Cloud is already remediated, so Cisco lists no customer action there.

Products with remediation steps instead of a release

• IOS XE Software: bug ID CSCwx51613.

• IOS XR Software: Cisco links a separate IOS XR guidance page from the advisory. Start there.

• Unified CCE and Packaged CCE (PCCE): bug ID CSCwx36769.

• Real Time Monitoring Tool (RTMT): bug ID CSCwx45230.

• Secure Email Gateway and Secure Email and Web Manager: updated automatically to Trusted Root 2.8.

• Unified Customer Voice Portal (CVP): updates the untrusted certificate list through the standard Automatic Root Certificates Update.

• Secure Firewall ASA, Firewall Management Center and Threat Defense: follow Cisco's dedicated emergency distrust guidance linked from the advisory.

Cisco also lists products still under investigation, including Secure Client (formerly AnyConnect), Secure Workload, Catalyst 9800 Series Wireless Controllers, Meraki vMX and Evolved Programmable Network Manager.

How serious it is

Brute-forcing a private key in seconds needs no special resources. That makes forged certificates cheap for anyone who tries. The risk is highest where a device trusts eMudhra CAs for TLS, device identity or code validation.

Cisco marks the advisory as informational and states that no workarounds are available. So the real fix is removing trust or installing the updates above. Whether attackers are using the keys is not confirmed yet; check the advisory for updates.

What to do now

1. Open the Cisco advisory and match your product list against the tables above.

2. Apply fixes that exist today. Plan maintenance windows for the ones due in 2027.

3. Find every place in your own estate that still trusts eMudhra CAs.

4. Check whether any of your own certificates chain to eMudhra, and reissue them from another CA if they do.

5. Review logs for unexpected certificates from eMudhra issuers.

Check trust stores

On Linux, list the system trust store, then decode each PEM file. Certificate files hold base64 text, so a plain grep over them will usually find nothing.

trust list | grep -i -B2 -A3 emudhra
for f in /etc/ssl/certs/*.pem; do openssl x509 -in "$f" -noout -subject -issuer 2>/dev/null | grep -qi emudhra && echo "$f"; done

On Windows, search the machine root and intermediate stores in PowerShell:

Get-ChildItem Cert:\LocalMachine\Root, Cert:\LocalMachine\CA | Where-Object { $_.Subject -match 'eMudhra' -or $_.Issuer -match 'eMudhra' } | Select-Object Subject, Issuer, Thumbprint

Check what your servers present

This prints the issuer of every certificate in the chain for a host:

echo | openssl s_client -connect example.com:443 -showcerts 2>/dev/null | grep -E '^( [0-9]+ s:|   i:)'

Replace example.com with your host. Any i: line naming eMudhra means that chain needs replacing.

Worked example: a manual-update email gateway

Secure Email Gateway gets Trusted Root 2.8 automatically. If updates are set to manual, Cisco says to run updatenow from the CLI to pull in the new Trusted Root 2.8:

updatenow

The advisory gives no verification command for this step. Repeat it on every gateway and on Secure Email and Web Manager.

What IT and security learners can take from this

This incident shows why PKI basics matter. A CA is only as safe as its key generation, and one weak ceremony can undermine every certificate below it. Learn the chain of trust, trust store management and revocation. Certificate lifecycle questions are common in security exams. The SY0-801 Security+ V8 guide shows how the current exam is organized. Practice the commands above in a lab so they are familiar when a real advisory lands.

If you are planning a security exam, browse our cybersecurity vouchers. Codes arrive by email within 12 hours of payment.

Sources

• Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities