Zero Radar
← feed
CriticalVulnerabilityCVE-2026-115557updated 31 Oct 2026, 23:52 UTC

Python and Linux/Windows trust store accept compromised eMudhra certificates

Some digital certificates from an Indian certificate authority (eMudhra/emSign) were stolen, so attackers could pose as trusted secure websites. Updates now stop your software from trusting them.

Attacks reported (oss-security)Partial fixOfficial, 8 sources
SeverityCriticalCVSS 9.4 of 10
Being exploited?ReportedBy oss-security, not officially confirmed yet
Fix available?PartlyPython 3.15.2, 3.14.10, 3.13.18, 3.12.16, 3.11.18; Ubuntu USN-8947-1 NSS update; Debian DSA-6599-1 nss update; Microsoft Windows out-of-band updates. · since 25 Oct 2026
How sure is this?Official, 8 sourcesBacked by an official source

How the attack works simplified

  1. 1CA keys compromisedeMudhra intermediate CA keys were stolen
  2. 2Attacker signs fake certForged certificate appears valid to software
  3. 3App connects to fake serverClient trusts the forged certificate chain
  4. 4Traffic interceptedAttacker can read or alter the connection
  5. ResultClient trusts impostor server

What happened

Intermediate CA keys from eMudhra/emSign were compromised, so certificates they signed cannot be trusted. Python's ssl module now uses a denylist, and NSS (Ubuntu, Debian) and Windows have removed or distrusted the affected CAs.

Why it is dangerous: An attacker holding these keys could create fake HTTPS certificates that look valid, letting them intercept or impersonate sites and downloads. Systems without these updates, especially Python users and Linux or Windows machines that have not updated their certificate stores, are at risk.

Are you affected?

You are affected if you run an unpatched Python release, use NSS on Ubuntu or Debian without the USN-8947-1 or DSA-6599-1 update, or run Windows without the out-of-band certificate update.

Python releases older than 3.15.2, 3.14.10, 3.13.18, 3.12.16, 3.11.18 (exact affected range not stated); NSS on Ubuntu (USN-8947-1) and Debian (DSA-6599-1); Windows systems missing Microsoft's out-of-band update; Git on macOS still trusts the certificates (reported).

What to do

  1. Update Python to 3.15.2, 3.14.10, 3.13.18, 3.12.16, or 3.11.18 or later
  2. On Ubuntu or Debian, install the NSS update from USN-8947-1 or DSA-6599-1
  3. On Windows, install Microsoft's out-of-band certificate update
  4. Check macOS tools such as Git, since reports say they still trust the affected certificates

Timeline

  1. 21 Oct 2026, 17:40 UTC
    Publicly disclosed
  2. 24 Oct 2026, 15:17 UTC
    Reported by NVD · NVD
  3. 24 Oct 2026, 16:15 UTC
    Reported by oss-security · oss-security
  4. 26 Oct 2026, 04:31 UTC
    Python reported on it · Python
  5. 26 Oct 2026, 18:17 UTC
    Ubuntu USN reported on it · Ubuntu USN
  6. 28 Oct 2026, 02:14 UTC
    Reported by oss-security · oss-security
  7. 28 Oct 2026, 02:15 UTC
    BleepingComputer reported on it · BleepingComputer
  8. 28 Oct 2026, 12:01 UTC
    Hacker News reported on it · Hacker News
  9. 28 Oct 2026, 12:10 UTC
    GitHub Advisory reported on it · GitHub Advisory
  10. 28 Oct 2026, 14:54 UTC
    Reported by oss-security · oss-security
  11. 28 Oct 2026, 15:00 UTC
    Reported by oss-security
  12. 31 Oct 2026, 23:52 UTC
    Debian Security reported on it · Debian Security

Sources 10 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Security press established security newsrooms

Community discussion sites, treat with care

Technical details

ID
CVE-2026-115557 · ZR-efcececa · ZR-777edb3e · ZR-e6e6a5b2 · ZR-9df47a48 · GHSA-x547-2835-q547 · ZR-1539e520
CVSS
9.4 / 10
EPSS
0.5% chance of exploitation within 30 days
Disclosed
21 Oct 2026, 17:40 UTC
On Zero Radar
before the radar started
Last change
31 Oct 2026, 23:52 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Python and Linux/Windows trust store accept compromised eMudhra certificates · Zero Radar