Cisco Informational for Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities

cisco-sa-emudhra-info-ScS22A1r · Cisco · October 23, 2026

Summary

Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered. A security researcher demonstrated that the private keys for eight eMudhra intermediate certificates were fundamentally broken due to an unprecedented error in their Key Generation Ceremony (KGC) in April 2025. This allows anyone to brute-force acquire these private keys within seconds. For more information, see eMudhra Intermediate CA Compromise ["https://emudhra.we-have-a-problem.com/"] and the Cisco Talos blog post Compromised eMudhra intermediate certificates ["https://blog.talosintelligence.com/compromised-intermediate-certificates/"]. For information about Splunk products and offerings, see Compromised eMudhra Intermediate Certificate Authorities on Splunk Products - October 2026 ["https://advisory.splunk.com/advisories/SVD-2026-1014"]. Important: If a product is not listed within this advisory, Cisco's review indicates that the product is not affected by this vulnerability. This advisory will be updated as additional information becomes available.

From Cisco (vendor's own words, quoted), quoted as published. Check the source before acting.

Why it's on these mode pages

Maritime: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
Pipeline: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
Freight rail: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
Passenger rail and transit: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
Highway and motor carrier: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)
Postal and parcel: Vendor table: Cisco (network and remote-access gear used in every mode, all modes) (matched by rule)

Change history

October 23, 2026: Initial public release.
October 24, 2026: Updated products under investigation, impacted, and not impacted.
October 26, 2026: Updated products under investigation, impacted, and not impacted.
October 27, 2026: Updated products under investigation, impacted, and not impacted.
October 28, 2026: Updated products under investigation, vulnerable, and confirmed not vulnerable. Added link to Splunk advisory.
October 30, 2026: Updated products under investigation, impacted, and not impacted.
November 4, 2026: Updated products impacted.
November 5, 2026: Updated products impacted.
November 6, 2026: Updated products under investigation and products impacted.
November 9, 2026: First collected by Watch

Securidigm Scout can match advisories like this one to the equipment on your own network, offline. securidigm.com