Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities

Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private keys for eight eMudhra intermediate certificates were fundamentally broken due to an unprecedented error in their Key Generation Ceremony (KGC) in April 2025. This allows anyone to brute-force acquire these private keys within seconds. For more information, see eMudhra Intermediate CA Compromise and the Cisco Talos blog post Compromised eMudhra intermediate certificates. For information about Splunk products and offerings, see Compromised eMudhra Intermediate Certificate Authorities on Splunk Products - October 2026. Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability. This advisory will be updated as additional information becomes available. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1r