October 26, 2026 at 8:55 AM EDT
eMudhra CA keys removed from AWS trust bundles (CVE-2026-111943)
important
Private keys for some eMudhra/emSign intermediate certificates could be recovered, so AWS is removing those roots from its trust stores. Customers should update ca-certificates and bundled boto3/botocore.
eMudhra / emSign certificates: CVE-2026-111943
- What: CVE-2026-111943, covered in AWS security bulletin 2026-150. The private keys for some eMudhra/emSign intermediate certificates could be recovered, so AWS is removing those root certificates from its trust stores.
- Severity: AWS rates it Important.
- Exploited: Not on CISA's Known Exploited Vulnerabilities list, and AWS has not reported any attacks.
What to do
- On Amazon Linux EC2 hosts, run
sudo yum update ca-certificates. - In Python Lambda functions that bundle their own copy of the AWS SDK, update boto3/botocore to 1.43.117.
- No action is needed for Amazon Cognito and AWS STS, which AWS has already updated, or for Amazon CloudFront, which AWS said it would finish updating by October 28.
- Clients that check certificate revocation were already protected.
General information only. Confirm fixed versions in the linked official advisories before patching.