English German
Breadcrumbs

ISN 2026-42: EMudhra CA Compromise Affecting IGEL OS

First published 29 October 2026 (Pre-Notification)

CVSS:3.1: 7.7 (High)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Summary

Several eMudhra intermediate CA certificates have insecure keys. This affects the following product versions:

  • IGEL OS 12

  • IGEL OS 11

  • Several IGEL OS 12 apps

Details

It has been discovered that eMudhra, a Certificate Authority (CA) trusted by operating systems (including IGEL OS), browsers and other network clients, mis-issued several intermediate certificates. As a result, a remote attacker can spoof any domain by presenting an eMudhra-signed X.509 certificate.

These certificates can no longer be trusted. Different components need to be updated to revoke that trust.

Update Instructions

  • OS 12: Upgrade the Base System app to version 12.10.1, or to 12.08.4 LTS PR 3 as soon as the latter is available on the IGEL APP Portal.

  • OS 11: IGEL OS 11 reached End of Maintenance in June 2026. To ensure continued access to security updates and support, we recommend migrating to IGEL OS 12.

  • Chromium, Firefox ESR and Microsoft Edge apps: The browser vendors have used their certificate revocation mechanisms for emergency mitigation (provided the browser installations have Internet access). Still, keep your web browser apps updated for the final removal of the affected certificate and for other security updates.

  • Azul JRE 17 app: IGEL is preparing an updated version.

  • Azul JDK 17 app: IGEL is preparing an updated version.

  • Azul JRE 21 app: IGEL is preparing an updated version.

References