Support Statement — Compromised eMudhra Intermediate CA Certificates
| KB ID: | 4952 |
| Product: |
Veeam Backup & Replication Veeam Backup for Microsoft 365 Veeam Backup for Salesforce Veeam ONE Veeam Service Provider Console Veeam Backup for Nutanix AHV Veeam Plug-In for AWS Veeam Plug-In for Microsoft Azure Veeam Plug-In for Google Cloud Veeam Backup for Oracle Linux Virtualization Manager and Red Hat Virtualization Veeam Management Pack for Microsoft System Center Veeam Recovery Orchestrator Veeam Sangfor aSV Plug-In Veeam Plug-In for Xen Veeam Plug-In for Proxmox VE Veeam Plug-in for Scale Computing HyperCore |
| Published: | 2026-10-21 |
| Last Modified: | 2026-10-28 |
Oops! Something went wrong.
Please, try again later.
Veeam is monitoring this incident and will update this article as new information becomes available.
Update 2026-10-28: Added information about Veeam Plug-Ins for cloud platforms and hypervisors.
Summary
In October 2026, eMudhra revoked eight of its intermediate certificate authority (CA) certificates because their private keys were weak enough to be recovered. Anyone who recovers these keys can issue certificates that a client trusts until the intermediates are blocked in its trust store. According to eMudhra's statement on the incident, none of the affected intermediates issued any certificates, and eMudhra is not aware of any evidence that the weak keys were exploited before the issue was disclosed.
The exposure lies in the certificate trust store of the operating system that Veeam components run on. Veeam components rely on that trust store to validate TLS connections to public endpoints, such as object storage, Microsoft 365, cloud hypervisors, Veeam license and update services, and SMTP servers. Until the trust store blocks the compromised intermediates, an attacker who can intercept this traffic could impersonate the endpoint without a certificate error.
The fix is to block the compromised certificates in the operating system trust store. For Veeam Software Appliance, Veeam Infrastructure Appliance, and the appliances and workers deployed by Veeam Plug-Ins, where Veeam manages the operating system, Veeam has delivered updates through Veeam Updater that block further use of the affected certificates. For all other Windows and Linux servers that host Veeam components, the fix comes from the operating system vendor, and no Veeam product update is required. This article describes how to apply the fix on each platform.
Veeam Agents and Veeam Plug-Ins for Enterprise Applications also use the certificate trust store of the operating system they run on. After the operating system is updated as described in this article, no further action is required for these products.
Solution
After the fix is applied, TLS or certificate trust errors may occur when connecting to a service whose certificate chains to the emSign ECC Root CA - G3 root or the AAA Certificate Services root.
Veeam Software Appliance (VSA) and Veeam Infrastructure Appliance
Veeam has released an update for the appliance that adds the compromised certificates to the appliance trust store blocklist, so that no process on the appliance trusts them. The update is delivered through Veeam Updater. Do not modify the appliance trust store manually.
Operating system and security updates are installed automatically. To install the update without waiting for automatic installation, perform the following steps:
- Log in to the Veeam Host Management console on the backup server.
- In the management pane, click Updates > Check for updates.
- On the Updates tab, select the available updates, then click Install Updates Now and confirm the operation.
- If a backup infrastructure component uses a custom update configuration, repeat these steps in the Veeam Host Management console of that component.
For more information, see Veeam Backup & Replication User Guide: Installing Updates.
Appliances and Workers Deployed by Veeam Plug-Ins
Veeam has released updates for the appliances and workers deployed by Veeam Plug-Ins. Do not modify their trust stores manually.
Veeam Plug-Ins for AWS, Microsoft Azure, and Google Cloud
This includes Veeam Plug-In for AWS, Veeam Plug-In for Microsoft Azure, and Veeam Plug-In for Google Cloud.
After updating to the latest Plug-In version, update the backup appliances.
Veeam Plug-Ins for Hypervisors
This includes the Veeam Plug-Ins for Nutanix AHV, Proxmox VE, oVirt KVM, Scale Computing HyperCore, HPE Morpheus VM Essentials, Platform9, Sangfor aSV, VergeOS, Xen, and KubeVirt. Workers deployed by these plug-ins remain in the virtual infrastructure between jobs. Update the plug-in(s) using Veeam Updater or by upgrading to at least Veeam Backup & Replication v13.1.2, then redeploy the workers.
Linux Machines With Veeam Components Installed
This includes Linux servers used as proxies, repositories, gateway servers, and other backup infrastructure components, and servers running Veeam Backup for Salesforce.
For fixed package versions and distribution-specific guidance, see the advisory from the distribution vendor:
- Red Hat: RHSB-2026-012 Certificate Compromise - eMudhra (Rocky Linux and AlmaLinux follow the Red Hat fix)
- Ubuntu: eMudhra CA Compromise Fixes Available
- Debian: DSA-6572-1 ca-certificates Security Update
Windows Machines With Veeam Components Installed
This includes Windows-based Veeam Backup & Replication, Veeam Backup for Microsoft 365, Veeam ONE, Veeam Service Provider Console, Veeam Recovery Orchestrator, and Veeam Management Pack for Microsoft System Center, and Windows servers used as backup infrastructure components.
With Access to Windows Update Servers
Microsoft has blocked the compromised intermediates on its platforms since October 20, 2026. Windows servers that receive automatic certificate trust list updates require no action.
To confirm that a server has received the updated list, run the following command from an elevated PowerShell prompt and check that the LastSyncTime value is October 20, 2026, or later:
Without Access to Windows Update Servers
Servers that are offline or air-gapped, or that have automatic root certificate updates disabled by policy, must be updated manually:
- Check whether automatic root certificate updates are disabled by the following Group Policy setting:
Computer Configuration > Administrative Templates > System > Internet Communication Management > Internet Communication settings > Turn off Automatic Root Certificates Update - For servers without internet access, download the current trust lists on a separate machine that has internet access. On that machine, run the following command from an elevated PowerShell prompt:
- Copy the
disallowedcert.sstfile fromC:\CTLto the offline server. On the offline server, run the following command from an elevated PowerShell prompt to import the file into the Untrusted Certificates store:
- Restart Veeam services on the machine, or simply reboot.
More Information
If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
