eMudhra Revokes 8 More CA Certificates as Microsoft and N-able Patch

Cryptographic key governance, enterprise mail infrastructure, and remote monitoring software required urgent remediation this week as certificate authority eMudhra revoked eight additional intermediate certificates, Microsoft resolved Windows Server updates that broke Exchange sign-ins, and N-able patched critical zero-day vulnerabilities in N-central.

In public-key infrastructure, BleepingComputer reported that certificate authority eMudhra revoked 8 additional RSA intermediate CA certificates on November 7, bringing its total number of affected intermediate CA certificates to 16. An incident report published Tuesday traced both sets of revocations to a custom Python script used in April 2025 to move keys between hardware security modules (HSMs). A bug in the script reduced 8 ECDSA private keys to 1 byte—allowing recovery by testing just 256 values, a flaw first disclosed on October 17 by security researcher Wayne—while also exposing 8 RSA private keys in host process memory in violation of CPS section 6.2.6. An earlier June 2025 warning sign involving mismatched certificate revocation list signatures went uninvestigated until October 2026. After Mozilla, Google, and Apple blocked the certificates and Microsoft issued out-of-band Windows updates on October 26, eMudhra announced it will exit the publicly trusted TLS certificate business, stop issuing under its G1 hierarchy by November 16, and complete an independent KPMG review by December 4.

For enterprise email administrators, BleepingComputer reported that Microsoft fixed Outlook on the web (OWA) sign-in, mail delivery, and mailbox replication issues on Exchange Server systems running Windows Server 2019 and later. The disruptions were triggered by a default memory limit on Endpoint Mapper when handling Endpoint Lookup calls introduced in the October 2026 Windows Server security updates. Microsoft resolved the bug in its November 2026 Patch Tuesday updates KB5131080 and KB5131090 and provided a temporary registry workaround setting EpmapSavedContextCap to 65536 for administrators who cannot immediately deploy the cumulative patches.

Meanwhile, in remote monitoring and management software, BleepingComputer reported that N-able released N-central 2026.4 HF2 after taking hosted N-central environments offline on November 9 across the Americas, Europe, and Asia-Pacific regions. Security researcher Sean Bales publicly disclosed the zero-day flaws late Sunday, November 8, publishing a GitHub repository called Able2Shell with proof-of-concept exploits affecting N-central Appliance 2026.4.0.31. The hotfix patches critical vulnerabilities including CVE-2026-125883 (multiple XXE flaws), CVE-2026-125878 (multiple OGNL injection flaws), CVE-2026-125879, CVE-2026-125880, CVE-2026-125881, CVE-2026-125882 (RCE credited to Nate Fair of Sprocket Security), and CVE-2026-91000. Threat intelligence firm Defused observed active scanning within 24 hours, while Shadowserver reported that internet-exposed N-central servers dropped from 1,338 on Monday to just over 148 across N-able's base of more than 500,000 organizations in over 140 countries.