Act
active
eMudhra Intermediate CA Compromised — PKI Trust Chain Affected
- Engineer — Act: A compromised intermediate CA undermines TLS trust for anything in that chain. Audit OS, browser, and container trust stores for the affected eMudhra intermediate CA and explicitly distrust it; inventory any certificates your services present that were issued under this CA and plan reissuance.
- SOC/IR — Plan: No active exploitation signals yet, but a rogue intermediate CA enables silent MITM. Build a detection to flag TLS sessions presenting certificates signed by the compromised eMudhra intermediate in your network inspection logs or proxy telemetry.
- Leader — Act: A compromised public intermediate CA is a systemic trust event that can affect any vendor using eMudhra-issued certificates. Confirm this quarter whether eMudhra is in your organization’s trusted CA inventory or used by key SaaS vendors, and request attestation where relevant.
- Signals: CVE-2026-111943 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.