Out-of-band Windows 11 updates released October 26, 2026; eMudhra issue reported October 17, 2026
Microsoft Pushes Out-of-Band Windows 11 Updates After the eMudhra Certificate Key Compromise
Microsoft released three out-of-band Windows 11 updates on October 26 to push updated certificate trust data tied to the compromise of eight intermediate CA private keys from eMudhra, which could allow attackers to forge TLS certificates for any domain. The packages, KB5134133, KB5134134, and KB5134130 across Windows 11 versions from 23H2 through 26H2, are non-security updates distributed only through the Microsoft Update Catalog, not through regular Windows Update, because they target disconnected, air-gapped, or locked-down machines that cannot fetch trust updates on their own. The eMudhra issue was reported on October 17 and drew a coordinated response from major technology companies to block the affected certificates. Connected machines receive trust list updates through normal channels, so most users will never see these packages and are advised to take no action.
Executives
A certificate authority key compromise attacks trust itself: a forged certificate makes a malicious site look legitimate to the systems that check it. The business exposure concentrates in your offline and locked-down estates, the machines least likely to have received the block list automatically, so ask whether anyone owns trust updates for air-gapped systems by name.
CIO / CISO
Inventory Windows 11 systems that do not take regular Windows Update, including lab, plant, and isolated network machines, and confirm their update packages include the updated Disallowed Certificate Trust List. Verify any certificates in your environment that chain to the removed roots, and record which offline systems were checked and when.
Engineers
Pull KB5134133, KB5134134, or KB5134130 from the Microsoft Update Catalog for the Windows 11 versions you run, from 23H2 through 26H2, and apply them to disconnected machines through your normal offline servicing path. Do not wait for these packages to appear in Windows Update, because they will not.
Everyone (non-IT)
If your computer is connected and updates normally, you do not need to do anything for this issue. Your system receives certificate trust updates on its own, and no download from a catalog is expected of you.