Critical CA Key‑Generation Flaw (CVE‑2026‑111943 & CVE‑2026‑111944) Undermines Trust in eMudhra Intermediate Certificates
What It Is – A cryptographic weakness in eMudhra’s key‑generation ceremony produced eight intermediate CA certificates whose private keys can be recovered with trivial effort (effective entropy 3‑8 bits). The flaw enables attackers to forge TLS or code‑signing certificates.
Exploitability – The weak keys have already been recovered by a researcher; the certificates have been revoked and blocked by major browsers and OS vendors. CVSS ≈ 9.8 (critical).
Affected Products – eMudhra intermediate Certificate Authority certificates (six TLS CAs, two code‑signing CAs).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous monitoring of third‑party PKI assets and evidence that key‑generation processes meet strong entropy requirements.
- Highlights a control gap in cryptographic key management that maps to a single VCF control objective, satisfying requirements across SOC 2, ISO 27001, NIST CSF 2.0, and others.
- Provides a concrete use‑case for Verisq’s Control Mapping capability: automatically correlating discovered compromised certificates with your asset inventory and generating audit‑ready evidence of remediation.
Recommended Actions
- Run Qualys VMDR + Certificate View queries (or equivalent tooling) to inventory any certificates issued by the eight compromised intermediates.
- Re‑issue affected TLS and code‑signing certificates from a trusted CA; revoke any still‑active compromised certificates.
- Update your PKI governance policies to require third‑party CA attestations of entropy testing and to log all certificate issuance for continuous assurance.
Source: Qualys Blog – Identify Compromised eMudhra Certificates