Search — “CVE-2026-111943”

Cisco Talos reports eight eMudhra intermediate CA certificates were issued with private keys generated from only single- or double-digit entropy, letting anyone holding those keys impersonate sites or sign code. Browsers, OSes, and Microsoft have blocked the certificates, and eMudhra revoked them, but software with independent trust stores or no revocation checking, such as VPN clients, proxies, CI/CD tooling, and embedded devices, may still trust them. Go assigned CVE-2026-111943 and fixed it in 1.27.3 and 1.26.10; Talos reports no malicious use observed as of October 21, 2026, so hunting should focus on exposure review rather than confirmed attack activity.

Certificate authority eMudhra revoked eight intermediate CA certificates whose P-384 private keys were generated with values below 256, letting anyone recover them trivially and forge trusted certificates. Mozilla, Google and Apple blocked the certificates, and Go 1.27.3 and 1.26.10 address the issue tracked as CVE-2026-111943. Software with its own certificate store or that does not check revocation may keep trusting the intermediates until updated, and the sources report no evidence of abuse.