Number Four Holds the Keys: eMudhra Intermediate CA Compromise

    Tuesday, October 27, 2026 In: Threat Research Print

    Date: 10/27/2026

    Severity: Critical

    Summary

    In April 2025, eMudhra issued eight intermediate CA certificates, including six for TLS and two for code signing, with dangerously weak P-384 private keys. The private keys used extremely small values, some below 256, with one set to just 4, making them recoverable from public certificates in less than a second. Attackers could use these keys to forge trusted HTTPS certificates for any domain or digitally sign malicious software. Following the report on October 17, 2026, major browsers blocked the affected certificates, but some non-browser applications may remain vulnerable if they do not check revocation status or Certificate Transparency. No exploitation in the wild has been reported so far, but affected trust stores and software runtimes still need to be updated. CVES : CVE-2026-111943, CVE-2026-113470 

    Indicators of Compromise (IOC) List

    Hash

    42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493

    45A883F349AEDFD5F3A649B5498FFB121712BA8B448F3F2A91DBC5A766FCDDBE

    0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19

    62B7F9868263F72F6911FC78CEAF72C1979158B7368BF648683BB2AA39B02E72

    E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838

    579480AEA166290BD3C643589E795FC0D0E54E86505D180F1DFF99EFD3199512

    432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3

    FD9D5C2DBBD4995AB69B8D50C439D9527B00529199C2FD01B2174EB58F07021F

    98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B

    5F1DED4DD590AF74631290CF073B122A2AAC6A1FA479778A0BD43579BD832699

    CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F

    7485B51C0ED192878FA1D2F948FB529AE1842CC5086C4B67F7BE5B2039DE9489

    9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4

    A496E23AC0CAB8155FC9B117B97EAE368EFCBB9041AEC8804D5A308D2D01C2D8

    4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1

    84112972B8E59D14560AE7E7119654474AAD119990CF3722BFC1E3B91615E1FD

    EBED6475C2C2D80FCB199F3FE8DD6E6B3CE60B77EB15D4E42C3DEC0C6F5B5105

    49DD353DC2B919A3770645117D0E60C16115E7D1BC259EEFE734B00EA434FE5F

    E0254C7FCDC265E2F0F8A428DABB75AB4AE039B4872D62F5EE57F0877D5A8A41

    5C0660A2B164910D8FF589C18E14552E9E0EC237DCEFE2CB736D41A4811F81A0

    43BFFA19D6EF651451F6841E019931E96F6F2EAEFF28AB4B6F1CE4576DE2717B

    63ECEFEE431D49523BC1136C4E72D0206A477086CAF606CD5CF025686C109CF8

    EC4FFA1AD0AC88081314B7AAFFEF6A91F97CD57291BB5BA686C5415F5EB4F6B6

    92C063D67E8F14DB71D288E11266FFDAF69CBF115F7BAB14F3BC2F68D25E0E30

    Certificate Serial

    c7c41efe92d825f05eae841a4a82c1

    6cada367fb1c100088120ea202d568

    a4aee678f23362b4c0e460b772f214

    8009928a64107601af05fa2f19f109

    296926c227a3a1526392b19482a504

    588b2e3c2bb8cda13e1a1209254321

    7818933f8f85b4619a2b35fba83d0a

    544b7f922c31ae220a4a922916f6e6

    d8f8685e4f2bd9d82402a85a1c1eb731

    e94223bde92f914e5ab9acabfdac3710

    a024fdf4ba665c785ce4a020483858b7

    05f078752dece7a1bb8595d303167171

    8d5a4811939ef447d77111cdd9849ae9

    91f347f1a5b7d39962b95e0ee4e299d1

    41e32b73ac185d6ce0d7480bacf84e69

    d6a5ef613b390f32ef9cdf349f772841

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    sha256hash IN ("0164D7CEAE5BB909C272AF151FF44B1177AE9B47D9424B94F1D9558C30934D19","42C4ACCD12C4F59597925E1A08A7A90102608543809308D50EC427E118BA1493","4B2460A466F95FD40113BCDCCA2CEB29B3B093921DE45474DA7DF48874C630B1","432EC25F0D28DE9006D97BF752F17BBB2CD41F669933FCB072D9A1148D0261F3","9E39DE2881273ACC225A149C72BA3E0F51424963669AB633EE1DC7DF5DB067B4","98B896625C0C230ADEEC3EB2CF6AAD5001ECF9156A68644E82374CE5833BC25B","CB6E15165AC802E9B3F993F16C25D41F4E81C21EBDE71AE1B012AC00BF9C7C3F","45A883F349AEDFD5F3A649B5498FFB121712BA8B448F3F2A91DBC5A766FCDDBE","62B7F9868263F72F6911FC78CEAF72C1979158B7368BF648683BB2AA39B02E72","E7568FE6E12331F4FD7DE61DA4C7559D0F8EB192A218D4741A3BA75184333838","579480AEA166290BD3C643589E795FC0D0E54E86505D180F1DFF99EFD3199512","FD9D5C2DBBD4995AB69B8D50C439D9527B00529199C2FD01B2174EB58F07021F","5F1DED4DD590AF74631290CF073B122A2AAC6A1FA479778A0BD43579BD832699","7485B51C0ED192878FA1D2F948FB529AE1842CC5086C4B67F7BE5B2039DE9489","A496E23AC0CAB8155FC9B117B97EAE368EFCBB9041AEC8804D5A308D2D01C2D8","84112972B8E59D14560AE7E7119654474AAD119990CF3722BFC1E3B91615E1FD","EBED6475C2C2D80FCB199F3FE8DD6E6B3CE60B77EB15D4E42C3DEC0C6F5B5105","49DD353DC2B919A3770645117D0E60C16115E7D1BC259EEFE734B00EA434FE5F","E0254C7FCDC265E2F0F8A428DABB75AB4AE039B4872D62F5EE57F0877D5A8A41","5C0660A2B164910D8FF589C18E14552E9E0EC237DCEFE2CB736D41A4811F81A0","43BFFA19D6EF651451F6841E019931E96F6F2EAEFF28AB4B6F1CE4576DE2717B","63ECEFEE431D49523BC1136C4E72D0206A477086CAF606CD5CF025686C109CF8","EC4FFA1AD0AC88081314B7AAFFEF6A91F97CD57291BB5BA686C5415F5EB4F6B6","92C063D67E8F14DB71D288E11266FFDAF69CBF115F7BAB14F3BC2F68D25E0E30")

    Reference:    

    eMudhra Intermediate CA Compromise                                                                               


    Tags

    VulnerabilityIndiaCVE-2026Government Services and Facilities

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.