Support Statement — Compromised eMudhra Intermediate CA Certificates
| KB ID: | 4952 |
| Product: |
Veeam Backup & Replication Veeam Backup for Microsoft 365 Veeam ONE Veeam Service Provider Console Veeam Management Pack for Microsoft System Center Veeam Recovery Orchestrator |
| Published: | 2026-10-21 |
| Last Modified: | 2026-10-21 |
Oops! Something went wrong.
Please, try again later.
Summary
In October 2026, eMudhra revoked eight of its intermediate certificate authority (CA) certificates because their private keys were weak enough to be recovered. Anyone who recovers these keys can issue certificates that a client trusts until the intermediates are blocked in its trust store. According to eMudhra's statement on the incident, none of the affected intermediates issued any certificates, and eMudhra is not aware of any evidence that the weak keys were exploited before the issue was disclosed.
The exposure lies in the certificate trust store of the operating system that Veeam components run on. Veeam components rely on that trust store to validate TLS connections to public endpoints, such as object storage, Microsoft 365, cloud hypervisors, Veeam license and update services, and SMTP servers. Until the trust store blocks the compromised intermediates, an attacker who can intercept this traffic could impersonate the endpoint without a certificate error.
The fix is to block the compromised certificates in the operating system trust store. For Veeam Software Appliance and Veeam Infrastructure Appliance, where Veeam manages the operating system, Veeam has delivered an update through Veeam Updater that blocks further use of the affected certificates. For all other Windows and Linux servers that host Veeam components, the fix comes from the operating system vendor, and no Veeam product update is required. This article describes how to apply the fix on each platform.
Veeam Agents and Veeam Plug-Ins for Enterprise Applications also use the certificate trust store of the operating system they run on. After the operating system is updated as described in this article, no further action is required for these products.
Solution
After the fix is applied, TLS or certificate trust errors may occur when connecting to a service whose certificate chains to the emSign ECC Root CA - G3 root or the AAA Certificate Services root.
Veeam Software Appliance (VSA) and Veeam Infrastructure Appliance
Veeam has released an update for the appliance that adds the compromised certificates to the appliance trust store blocklist, so that no process on the appliance trusts them. The update is delivered through Veeam Updater. Do not modify the appliance trust store manually.
Operating system and security updates are installed automatically. To install the update without waiting for automatic installation, perform the following steps:
- Log in to the Veeam Host Management console on the backup server.
- In the management pane, click Updates > Check for updates.
- On the Updates tab, select the available updates, then click Install Updates Now and confirm the operation.
- If a backup infrastructure component uses a custom update configuration, repeat these steps in the Veeam Host Management console of that component.
For more information, see Veeam Backup & Replication User Guide: Installing Updates.
Linux Machines With Veeam Components Installed
This includes Linux servers used as proxies, repositories, gateway servers, and other backup infrastructure components.
For fixed package versions and distribution-specific guidance, see the advisory from the distribution vendor:
- Red Hat: RHSB-2026-012 Certificate Compromise - eMudhra (Rocky Linux and AlmaLinux follow the Red Hat fix)
- Ubuntu: eMudhra CA Compromise Fixes Available
- Debian: DSA-6572-1 ca-certificates Security Update
Windows Machines With Veeam Components Installed
This includes Windows-based Veeam Backup & Replication, Veeam Backup for Microsoft 365, Veeam ONE, Veeam Service Provider Console, Veeam Recovery Orchestrator, and Veeam Management Pack for Microsoft System Center, and Windows servers used as backup infrastructure components.
With Access to Windows Update Servers
Microsoft has blocked the compromised intermediates on its platforms since October 20, 2026. Windows servers that receive automatic certificate trust list updates require no action.
To confirm that a server has received the updated list, run the following command from an elevated PowerShell prompt and check that the LastSyncTime value is October 20, 2026, or later:
Without Access to Windows Update Servers
Servers that are offline or air-gapped, or that have automatic root certificate updates disabled by policy, must be updated manually:
- Check whether automatic root certificate updates are disabled by the following Group Policy setting:
Computer Configuration > Administrative Templates > System > Internet Communication Management > Internet Communication settings > Turn off Automatic Root Certificates Update - For servers without internet access, download the current trust lists on a separate machine that has internet access. On that machine, run the following command from an elevated PowerShell prompt:
- Copy the
disallowedcert.sstfile fromC:\CTLto the offline server. On the offline server, run the following command from an elevated PowerShell prompt to import the file into the Untrusted Certificates store:
- Restart Veeam services on the machine, or simply reboot.
More Information
If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
Spelling error in text
Thank you!
Your feedback has been received and will be reviewed.
KB Feedback/Suggestion
This form is only for KB Feedback/Suggestions, if you need help with the software open a support case
Thank you!
Your feedback has been received and will be reviewed.
Oops! Something went wrong.
Please, try again later.