Microsoft Windows tizimlari uchun sertifikat ishonchini avtomatik yangilashni olmaydigan tizimlarni himoya qilish maqsadida, buzilgan eMudhra sertifikat markazi kalitlari bilan bog'liq sertifikatlarga ishonchni bekor qilish uchun Windowsning navbatdan tashqari (OOB) yangilanishlarini chiqardi.
Windows 11 24H2, 25H2 va 26H2 versiyalari uchun KB5134133 va Windows 10 21H2 va 22H2 versiyalari uchun KB5134125 yangilanishlari 26-oktabrda chiqarildi.
Yangilanishlar Internetga ulanishi bo'lmagan tizimlar, Microsoftning sertifikat yangilash xizmatiga ulana olmaydigan qurilmalar va avtomatik Sertifikat Ishonch Ro'yxati (CTL) yangilanishlari o'chirilgan tizimlar uchun mo'ljallangan.
Yangilanishlar aprel 2025-yilda yaratilgan va deyarli darhol tiklanishi mumkin bo'lgan darajada zaif bo'lgan sakkizta eMudhra oraliq sertifikat markazi shaxsiy kalitlari aniqlangandan so'ng chiqarildi.
Barcha sakkizta kalit 256 dan kichik qiymatlarga ega bo'lib, har kim ularni atigi 256 ta mumkin bo'lgan raqamni sinab tiklashi mumkin edi.
Buzilgan kalitlar hujumchilarga qonuniy veb-saytlar uchun sertifikatlar soxtalashtirish va shifrlangan aloqalarni ushlab qolish imkonini berishi mumkin edi.
Oshkor etilgandan so'ng, eMudhra sakkizta buzilgan oraliq sertifikatni bekor qildi va Mozilla, Google, Apple hamda boshqa dasturiy ta'minot ishlab chiqaruvchilari ham ularni bekor qila boshladi.
Javoban Microsoft avval Windows Taqiqlangan Sertifikat Ishonch Ro'yxatini yangilab, sakkizta ta'sirlangan oraliq sertifikat markazlarini, jumladan TLS uchun oltita va kod imzolash uchun ikkita markazni blokladi.
Shuningdek, kompaniya Microsoft Edge va WebView2 uchun CRLSet yangilanishini chiqarib, ta'sirlangan TLS sertifikatlarini blokladi, bu esa brauzer yangilanishisiz bloklashni ta'minladi.
Endi Microsoft Windows ishonch ro'yxatidan ta'sirlangan sertifikat ierarxiyalari bilan bog'liq yettita sertifikatni olib tashlash orqali qo'shimcha choralar ko'rmoqda.
"26-oktabrda Microsoft ta'sirlangan ierarxiyalar bilan bog'liq yettita sertifikatni — oltita eMudhra G3 ildiz sertifikati va AAA Certificate Services o'zaro imzolash sertifikatini — Windows ishonch ro'yxatidan olib tashlaydigan navbatdan tashqari Windows yangilanishini chiqardi", deb tushuntirdi Microsoft.
Yangi yangilanish CA tomonidan berilgan boshqa sertifikatlarni tekshirish uchun ishlatiladigan eMudhra ildiz sertifikatlariga ishonchni ham bekor qiladi.
Microsoft 27-oktabrda xuddi shu yettita sertifikat Edge ishonch ro'yxatidan ham olib tashlanishini aytdi.
"Ildizni ishonch ro'yxatidan olib tashlash ma'lum ta'sirlangan oraliq sertifikat markazlarini bekor qilish bilan bir xil emas", deb tushuntiradi Microsoft.
"Bu aniqlangan buzilgan oraliq kalitlarni bloklashdan kengroq alohida ishonch qaroridir. Muayyan moslik ehtiyoji bo'lgan tashkilotlar o'z xavfsizlik baholashi va siyosatlariga muvofiq sertifikatga mahalliy ravishda ishonch berishni tanlashi mumkin."
Kompaniya ma'murlarga yangilanishni uzilgan Windows tizimlariga o'rnatishni va olib tashlangan ildizlarga bog'liq har qanday sertifikatlarni aniqlashni maslahat beradi, chunki ular almashtirilishi mumkin.
Microsoft shuningdek, qolgan eMudhra ildizlarini tekshirmoqda va zarurat tug'ilganda qo'shimcha ishonch o'zgarishlarini amalga oshirishi mumkin.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining atigi 37 foizi bloklanadi
Umumiy oldini olish ko'rsatkichlari dastlabki kirishdan keyin sodir bo'ladigan narsalarni yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanganda, oldini olish keskin pasayadi.
Blue Report 2026 mijozlar ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika-texnika himoyani o'lchaydi.
Hisobotni oling
Microsoft has released out-of-band (OOB) Windows updates to remove trust in certificates tied to compromised eMudhra certificate authority keys, protecting systems that do not receive automatic certificate trust updates.
The KB5134133 update for Windows 11 versions 24H2, 25H2, and 26H2 and the KB5134125 update for Windows 10 versions 21H2 and 22H2 were released on October 26.
The updates are for systems without Internet access, devices that cannot access Microsoft's certificate-update service, and those where automatic Certificate Trust List (CTL) updates have been disabled.
The updates were released after the discovery of eight eMudhra intermediate certificate authority private keys that were so weak they could be recovered almost instantly.
All eight keys were generated in April 2025 and had values smaller than 256, allowing anyone to recover them by testing just 256 possible numbers.
The compromised keys could have allowed attackers to forge certificates for legitimate websites and intercept encrypted communications.
After the disclosure, eMudhra revoked the eight compromised intermediate certificates, and Mozilla, Google, Apple, and other software vendors also began revoking them.
In response, Microsoft previously updated the Windows Disallowed Certificate Trust List to block the eight affected intermediate certificate authorities, including six used for TLS and two for code signing.
The company also released a CRLSet update for Microsoft Edge and WebView2 to block affected TLS certificates, which enabled the block without requiring a browser update.
Microsoft is now taking further steps by removing seven certificates associated with the affected certificate hierarchies from its Windows trust list.
"On October 26, Microsoft released an out-of-band Windows update that removes seven certificates associated with the affected hierarchies: six eMudhra G3 roots and an AAA Certificate Services cross-sign, from the Windows trust list," Microsoft explained.
The new update goes further by also removing trust in the eMudhra root certificates used to verify other certificates issued by the CA.
Microsoft says the same seven certificates will also be removed from the Edge trust list on October 27.
"Removing a root from a trust list is not the same as revoking the known impacted intermediate certificate authorities," explains Microsoft.
"This is a separate trust decision, broader than blocking the identified compromised intermediate keys. Organizations with a specific compatibility need may choose to trust a certificate locally, subject to their own security assessment and policies."
The company advises admins to install the update on disconnected Windows systems and identify any certificates that depend on the removed roots, as they may need to be replaced.
Microsoft is also investigating the remaining eMudhra roots and may make additional trust changes as needed.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report