Microsoft released three out-of-band Windows 11 updates on October 26, 2026, to address a compromise involving eight intermediate CA private keys from eMudhra, which could allow attackers to forge TLS certificates. These updates, specifically for air-gapped or locked-down machines, will not be visible to most users as they are distributed through the Microsoft Update Catalog and not through regular Windows Update. The eMudhra security issue was reported on October 17, leading to a coordinated response from major tech companies to block the affected certificates. IT admins managing offline systems need to ensure their packages include the updated Disallowed Certificate Trust List and verify any certificates that chain to the removed roots, while average users are advised to take no action

Microsoft Ships Out-of-Band Windows 11 Updates Over eMudhra Compromise

Microsoft released three non-security out-of-band Windows 11 updates on October 26, pushing offline certificate-trust data tied to the eMudhra key compromise. These packages target only disconnected, air-gapped, or locked-down machines, so most consumers will never even see them appear in Windows Update. They bundle fixes into KB5134133, KB5134134, and KB5134130 across Windows 11 versions from 23H2 through 26H2, and ship from the Microsoft Update Catalog only. The move follows the October 2026 breach of eight eMudhra intermediate CA private keys, which could let attackers forge TLS certificates for any domain.

Microsoft Ships Out-of-Band Windows 11 Updates Over eMudhra Compromise @ NT Compatible