eMudhra CA Certificate Compromise (CVE-2026-91403,CVE-2026-114820) Workaround

eMudhra CA Certificate Compromise (CVE-2026-91403,CVE-2026-114820) Workaround


eMudhra, a third-party certificate authority (CA), recently reported a key weakness affecting some of its intermediate CA certificates. These intermediates chain to roots trusted by the Mozilla, Microsoft, Apple, and Chrome root programs, as well as by many downstream trust stores. As a result, major browser vendors and operating system providers have revoked trust in the affected intermediate CAs.
For more details about the incident, go here.   

Reported CVE : CVE-2026-91403 , CVE-2026-114820 (new)

Impact on ServiceDesk/AssetExplorer  

  1. SSL certificate used to host the application: If your application is hosted with an a SSL certificate issued by eMudhra, please replace it. Get a new SSL certificate from your vendor and follow these steps to import it into the application.

  2. eMudhra certificates in the application’s trust store: By default, the application’s trust store includes eMudhra certificates, and these must be removed.  The application relies on this trust when it communicates with other services, such as mail server and integrated applications. How severely you are affected depends on your deployment environment. For example, an application isolated from external networks will be affected less. Follow the workaround detailed below to remove the trust for eMudhra certificates.

  3. Active Directory integration: For Active Directory integration, the application uses native LDAP requests, which rely on the trust store of the server’s operating system. Make sure the application server  has the latest OS updates. For more information, see Microsoft’s response to the compromised eMudhra CA keys. 

Workaround 

The workaround removes trust for the eMudhra CA by making the following changes to the Java runtime bundled with the application:
  1. Removes the eMudhra root certificates from the cacerts file.
  2. Removes the eMudhra root certificates from the jssecacerts file, if it exists.
  3. Updates the blocked.certs file.
To verify that the workaround has been applied correctly, connect to the following test URLs and check whether each connection is blocked or succeeds as expected. The following URLs are listed on eMudhra’s official page for this incident:
  1. "https://dv-g3b-emudhra.we-have-a-problem.com/"
  2. "https://dv-g3c-emudhra.we-have-a-problem.com/"
  3. "https://ov-g3b-emudhra.we-have-a-problem.com/"
  4. "https://ov-g3c-emudhra.we-have-a-problem.com/"
  5. "https://ev-g3b-emudhra.we-have-a-problem.com/"
  6. "https://ev-g3c-emudhra.we-have-a-problem.com/"
  7. "https://dv-g3b-aaa-emudhra.we-have-a-problem.com/"
  8. "https://dv-g3c-aaa-emudhra.we-have-a-problem.com/"
  9. "https://ov-g3b-aaa-emudhra.we-have-a-problem.com/"
  10. "https://ov-g3c-aaa-emudhra.we-have-a-problem.com/"
  11. "https://ev-g3b-aaa-emudhra.we-have-a-problem.com/"
  12. "https://ev-g3c-aaa-emudhra.we-have-a-problem.com/"
  13. "https://dv-g3b-noct-emudhra.we-have-a-problem.com/"
  14. "https://dv-g3b-aaa-noct-emudhra.we-have-a-problem.com/"

Applying the workaround 

  1. Download the attached emudhra_fix.zip tool and extract it to the <SDP_HOME>\emudhra_fix directory.

  2. Open command prompt from <SDP_HOME>\emudhra_fix directory and run the following:
Windows : emudhra_fix.bat [options] [parameters]
Linux/Others : ./emudhra_fix.sh [options] [parameters]

Usage and examples

Info
The examples below use the Windows command.
On Linux and other platforms, replace emudhra_fix.bat with ./emudhra_fix.sh.

Command

What it does

emudhra_fix.bat

 Applies the fix and then runs a full verification.

emudhra_fix.bat apply
 Applies the fix without verification.

emudhra_fix.bat verify

Runs a full verification without applying the fix. Checks that the fix is present and connects to the test URLs listed earlier to confirm they are blocked.

emudhra_fix.bat verify:local

Checks only whether the fix is present in the files. No network connections are made.

emudhra_fix.bat verify:fips

Runs verification for applications running in FIPS mode. The fix itself is the same for FIPS and non-FIPS modes; only the verification differs.

emudhra_fix.bat verify -url <URL>

Checks whether the application blocks a specific URL that presents an eMudhra certificate.

emudhra_fix.bat verify -proxy <host>:<port>:<username>:<password>

Runs verification through the specified proxy. 

emudhra_fix.bat usage

Displays the readme with all options and examples.


[ Out-Dated ] Workaround

WarningThis workaround addresses CVE-2026-91403 only. It blocks the compromised eMudhra intermediate certificates but does not remove eMudhra certificates from the default trust store. It blocks the affected connections in all non-FIPS setups. If FIPS mode is enabled, use the emudhra_fix tool described above instead.
  1. Right-click the appropriate link and select "Save link as..." to save the file locally as emudhra.certs file.

  2. Go to <SDP_HOME>\jre\lib\security directory. You'll find either blocked.certs ( newer versions with jre11+ ) or blacklisted.certs ( jre 8 version)

  3. Backup the <SDP_HOME>\jre\lib\security\blocked.certs file as blocked.bak-emudhra

  4. Copy-paste and replace the downloaded file as <SDP_HOME>\jre\lib\security\blocked.certs
    Note : In case of blacklisted.certs name accordingly.

  5. Restart the application service.


References Links

https://docs.azul.com/core/emudhra-workaround
https://emudhra.we-have-a-problem.com/