eMudhra CA certificate compromise — Advisory
Published: [October 23, 2026]
CVE ID: N/A
Severity: High
Absolute product status: Absolute Secure Access self-hosted: action recommended as described below. Absolute Secure Access cloud and Absolute Secure Web Gateway: both are cloud services being patched by Absolute, no customer action required. All other Absolute products: not affected.
Overview
In October 2026, private keys for several eMudhra intermediate certificate authorities were reported compromised. Software that trusts these intermediate certificates could accept a certificate issued by an attacker to impersonate a legitimate site or service. Absolute Security has assessed its products and services. Absolute Secure Access and Absolute Secure Web Gateway include certificate stores that trust the affected intermediates. We are patching both. Self-hosted Secure Access customers can remove the risk today with the interim step below.
Key Facts:
- Absolute Secure Access server: the Java Development Kit (JDK) that ships with all current versions of Secure Access contains root certificates that trust the eMudhra intermediate certificates. This creates the possibility of an attacker-in-the-middle exploit against the Secure Access server when administrators use OIDC-based authentication to an external identity provider (IdP).
- A fully patched version of the Secure Access server will be available in an upcoming update. We will update this advisory when the update's release date is determined. Cloud (SaaS) instances of Secure Access are being patched by Absolute. Cloud customers do not need to take any action.
- Absolute Secure Web Gateway: the service contains root certificates that trust the eMudhra intermediate certificates. Users of the Inspect and Isolate modes could connect to an attacker-controlled site that uses a compromised certificate to impersonate a legitimate site, without the expected certificate warning. Because protection features, including antivirus, browser isolation and data loss prevention, are not impacted customers do not need to take action at this time. A fully patched version of Secure Web Gateway will be live on October 25, 2026.
- Absolute Secure Endpoint, RfA, RfA, FirmGuard, and Insights for Network are not affected.
Recommended Remediation:
For self-hosted Absolute Secure Access customers, you can invalidate the compromised certificates now, before the patched update is released by following the procedure here.
If you need help, contact Absolute Supprt.
- For Absolute Secure Access cloud customers, no action is required.
- For Absolute Secure Web Gateway customers, no action is required. The patched service will be live on October 25, 2026.
- For your own environment, remove trust in the affected eMudhra intermediate certificates from systems and applications that maintain their own certificate stores, and apply vendor updates as they become available. The Node.js October security release updates its certificate bundle to address the compromise.