.svg?width=93&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Home"){kind=logo}
.svg?width=7&quality=80&auto=webp&format=auto&cache=true&immutable=true&cache-control=max-age%3D31536000 "Top Navigation - Sign in - Icon")
High
Advisory: eMudhra Intermediate CA Certificates Compromised
CVE(S)
N/A
PRODUCT(S)
Sophos UTM
Sophos ZTNA
Sophos Firewall
Updated
2026 Oct 27
Article Version
1
First Published
2026 Oct 27
Publication ID
sophos-sa-20261027-emudhra
Workaround
Yes
Overview
On October 17, 2026, a security researcher reported a critical cryptographic flaw in eight intermediate CA certificates by the Indian CA eMudhra Limited to Mozilla. Exploiting this flaw allows MitM attackers to impersonate websites and decrypt traffic. The certificates were subsequently revoked and are no longer to be trusted.
Applies to the following Sophos products
| Product | Remediation |
|---|---|
| Sophos Firewall | Hotfixed on October 26, 2026 in v23, v22, v21.5, v20.0 MR3, v20.0 MR2, v19.0 MR2. No action is required to receive the fix with the "Allow automatic installation of hotfixes" feature enabled on remediated versions. Enabled is the default setting. |
| Sophos UTM (EOL) | Pattern update on October 22, 2026 |
| Sophos ZTNA | Fixed on October 26, 2026 in ZTNA Gateway v2.3 |
Other Sophos products are not affected.
Workaround
Sophos Firewall where hotfixes are not enabled or available
Sophos removed the eMudhra root CAs from product trust stores. Follow these steps where hotfixes are not enabled or available:
Log in to your Sophos Firewall WebAdmin UI.
Navigate to Certificates > Certificate authorities using the left-hand navigation menu.
Locate the affected eMudhra root CAs from the list:
AAACertificateServices
emSign ECC Root CA - G3
Click the Delete (trash bin icon) next to each of these certificate authorities to remove them from your firewall's trusted certificate store.
Related information
Sophos Responsible Disclosure Policy
To learn about Sophos security vulnerability disclosure policies and publications, see the Responsible Disclosure Policy.