Skip to content
Compromised eMudhra Certificates Allow Forged SSL Certificates

Compromised eMudhra Certificates Allow Forged SSL Certificates

First seen 21 Oct 2026, 02:19 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 21, 2026 at 09:17 UTC
  • •Eight eMudhra intermediate certificates were compromised due to weak private keys.
  • •Major browsers blocked the certificates, but other software remains at risk.
  • •Cloudflare has released updates and urged customers to review their server configurations.

On October 19, 2026, Cloudflare disclosed that eight eMudhra intermediate certificates were compromised due to weak private keys generated in April 2025. These keys, which were integers below 256, allowed attackers to forge certificates for any domain, posing a significant risk of impersonation and traffic interception. Major browsers like Firefox, Chrome, and Apple quickly blocked these certificates starting October 17, 2026. However, software outside of browsers remains vulnerable, as tools like curl on macOS continued to accept the compromised chain. Cloudflare has released updates for its services and urged customers to take action on their own servers, especially those using mutual TLS or running containers. The issue has been tracked as CVE-2026-111943, published on October 21, 2026. No active exploitation has been reported on Cloudflare services, but the potential for abuse exists.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2025-04-01
Weak keys generated during key ceremony
Private keys for eMudhra certificates were generated with values below 256, allowing easy recovery.
Itnews.Au
2026-10-17
Browsers block compromised certificates
Firefox and Chrome blocked the compromised certificates, protecting users from potential abuse.
Bleepingcomputer
2026-10-19
Cloudflare discloses compromise
Cloudflare announced the compromise of eMudhra certificates and began patching its services.
Blog.Cloudflare
2026-10-20
Cloudflare releases updates
Cloudflare published updates for its WARP and 1.1.1.1 clients to mitigate the issue.
Blog.Cloudflare
2026-10-21
CVE-2026-111943 published
The vulnerability related to the compromised eMudhra certificates was officially documented.
Sploitus

More articles in this cluster (5)

Following this threat?

Track Apple and CVE-2026-111943 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 2

Common questions

What actions should customers take?
Customers should upgrade their Cloudflare One Clients and review their server configurations to ensure they are not using the compromised certificates.
Are there any known exploits in the wild?
No active exploitation has been reported on Cloudflare services, but the potential for abuse exists.
What is the nature of the vulnerability?
The vulnerability stems from weak private keys that allow attackers to forge certificates for any domain.