First published 2 November 2026 (Pre-Notification)
CVSS:3.1: 6.5 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Summary
Several eMudhra intermediate CA certificates have insecure keys. This affects the following product versions:
-
Universal Management Suite (UMS)
Details
It has been discovered that eMudhra, a Certificate Authority (CA) trusted by operating systems, browsers and other network software (including IGEL UMS), mis-issued several intermediate certificates. As a result, a remote attacker can spoof any domain by presenting an eMudhra-signed X.509 certificate.
These certificates can no longer be trusted. Different components need to be updated to revoke that trust. For most of its operations, however, UMS uses a very small custom trust store, so these are not affected. For the rest of its operations, it uses the Java trust store, which needs to receive a security update.
Update Instructions
-
Upgrade to UMS 12.16.100 as soon as it is available from the IGEL App Portal.
References
-
Dennis Jackson et al., eMudhra Intermediate CA Compromise: https://emudhra.we-have-a-problem.com
-
eMudhra Statement on Recent Certificate Security Incident: https://emudhra.com/en/post/certificate-security-incident
-
CVE-2026-114820 (Java): https://www.cve.org/CVERecord?id=CVE-2026-114820