Critical CA Key‑Generation Flaw (CVE‑2026‑111943 & CVE‑2026‑111944) Undermines Trust in eMudhra Intermediate Certificates
A flaw in eMudhra’s key‑generation ceremony produced eight intermediate CA certificates with near‑zero entropy, enabling attackers to forge TLS or code‑signing certificates. The incident stresses the importance of continuous PKI oversight and control‑mapping evidence for audit readiness.
ADTP Breach Watch· October 24, 2026· Qualys Blog
SeverityCritical
Type📋 Vulnerability
ConfidenceHigh
ReportedOct 24, 2026
Technology & SaaSTechnology & SaaS providers that rely on eMudhra‑issued TLS or code‑signing certificatesVulnerability Exploit
What happened
Researchers recovered private keys for eight eMudhra intermediate certificates after discovering that the key‑generation process used weak P‑384 keys with only 3‑8 bits of entropy. The compromised certificates have been revoked and blocked by major browsers and OS vendors.
Why it matters for trust and compliance
The incident tests the control objective of secure cryptographic key generation and management, a single VCF control that maps to multiple frameworks (e.g., NIST CSF 2.0, ISO 27001). Demonstrating continuous monitoring of third‑party PKI assets provides defensible audit evidence.
Enables continuous discovery of compromised third‑party certificates and evidence of remediation.
Supports audit‑ready documentation of PKI governance controls across frameworks.
Who is affected
Technology & SaaS providers that rely on eMudhra‑issued TLS or code‑signing certificates
Recommended actions
Inventory all certificates issued by the eight compromised eMudhra intermediates using Qualys VMDR or equivalent tooling.
Re‑issue and deploy new certificates from a trusted CA; revoke any compromised ones.
Enhance PKI policies to require entropy validation and logging of all third‑party certificate usage.
Details
CVEs
CVE-2026-111943, CVE-2026-111944
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.