At a glance
- Cisco warns that trust in eMudhra root and intermediate CAs should be removed.
- Private keys for eight intermediate CA certificates were weakened and could be brute-forced in seconds.
- Multiple Cisco products are in scope; Cisco says products not listed in the advisory are not affected.
- Follow Cisco guidance or the corresponding product update; no temporary workaround is currently available.
Cisco calls for eMudhra CA distrust after intermediate certificate keys found weak
Cisco says a 2025 key-generation flaw left private keys for eight eMudhra intermediate CA certificates weak enough to brute-force in seconds. Review affected Cisco products and apply the corresponding distrust guidance or update.
In this article
Cisco PSIRT says a flaw in eMudhra’s key generation process left private keys for eight intermediate CA certificates vulnerable to brute-force recovery in seconds. See the Cisco advisory to check the product list and applicable guidance.
Overview and technical details
The issue stems from an error in the Key Generation Ceremony (KGC) in April 2025. It severely weakened the private keys for eight eMudhra intermediate CA certificates. Cisco is determining which products and services are affected; some products may require distrust of eMudhra CAs or a software/certificate update.
| Field | Details |
|---|---|
| Advisory source | Cisco PSIRT |
| Event | Private keys for eight eMudhra intermediate CA certificates could be brute-forced in seconds |
| CVE and CVSS | Not provided in the source record |
| Workaround | Cisco says no temporary workaround is currently available |
Affected systems
Cisco says products not listed in the advisory are not affected. The table below gives the products, branches, or remediation status included in the source record; dates in parentheses are the stated target release or remediation dates.
| Product/branch | Stated scope or remediation |
|---|---|
| IOS Software; IOS XE Software; IOS XE Software Guestshell | Apply the Cisco IOS XE and GuestShell CA Trust eMudhra Distrust Guide; IOS XE Software Guestshell references CSCwx51613. |
| Secure Firewall Adaptive Security Appliance; Secure Firepower Management Center (FMC) Software; Secure Firewall Threat Defense Software | Apply Cisco Secure Firewall/Firewall Management Center/Adaptive Security Appliance guidance - Emergency Distrust of eMudhra Root and Intermediate Certificate Authorities. |
| Packaged Contact Center Enterprise (PCCE); Unified Contact Center Enterprise (CCE) | CSCwx36769. |
| Real Time Monitoring Tool (RTMT) | CSCwx45230. |
| Secure Email and Web Manager; Secure Email Gateway | Automatically update to Trusted Root 2.8; for manual updates, use cli->updatenow. |
| Unified Customer Voice Portal (CVP) | Automatically update the untrusted certificate list through Automatic Root Certificates Update. |
| Adaptive Security Device Manager (ASDM); Security Manager | 11.0.32.1 (Mar 2027). |
| ASR 5000 Series Software (StarOS) | Nov 15, 2026. |
| Collaboration Endpoints running RoomOS Software (Board, Desk, and Room Series) | RoomOS On-premises 11.41.2.3, 26.7.4.3; RoomOS Cloud October 2026 / 26.10.1 for the current generation, 11.41.1 and later for the previous generation. |
| Cyber Vision | 5.6.2 (Nov 2026). |
| Duo | Cloud remediated - no customer action required. |
| Duo Access Gateway; Duo Agentic Authorization Connector; Duo Network Gateway | 3.2.0; 1.0.1; 3.4.1, respectively. |
| Enterprise Chat and Email | ES202701 (Jan 2027). |
| Identity Services Engine (ISE); ISE Passive Identity Connector (ISE-PIC) | ISE 3.3P13 (Apr 2027), ISE 3.4P8 (Apr 2027), ISE 3.5P5 (Dec 2026). |
| Intersight Virtual Appliance | 1.1.8-2 (Nov 2026). |
| IOS XR Software | 26.4.1 (Nov 30, 2026). |
| IP Phone 8800 Series | 14.4(1)SR5 (Jan 2027), 14.4(1)ES1 (Nov 13, 2026). |
| IP Phone 6800, 7800 and 8800 Series with Multiplatform Firmware | 12-0-8MPP0001 (Dec 2026). |
| Meraki Dashboard | Cloud remediation in progress - no customer action required. |
| Meraki MV Smart Camera Firmware | Nov 18, 2026. |
| Network Services Orchestrator (NSO) - Container only impacted | NSO 6.4.16 (Dec 8, 2026), 6.6.10 (Nov 17, 2026), 6.7.5 (Nov 17, 2026), 6.8 (Nov 19, 2026); the certificate package can also be upgraded with DNF as detailed below. |
| Optical Site Manager | 6.4.1 (Nov 2026). |
| Policy Suite (CPS) | 26.2.0 (Oct 30, 2026). |
| Provider Mobility | 2026.04.0 (Nov 6, 2026). |
| Secure Access (Cloud) | Cloud remediated - no customer action required. |
| Secure Network Analytics | 7.6.0 and 7.6.1 Rollup patch (Nov 2026). |
| Smart PHY | 27.1 (Mar 16, 2027). |
| Spaces Connector | Nov 30, 2026. |
| Telemetry Broker | Remediation script (Nov 15, 2026). |
| ThousandEyes Enterprise Agent Application-hosting Agent; Docker Agent; Meraki Agent | Application-hosting Agent 5.2.2; Docker Agent and Meraki Agent 1.247.3. |
| ThousandEyes Enterprise Agent BrowserBot | Chromium version 156 (Nov 2026). |
| ThousandEyes Enterprise Agent Linux Agent | Customer remediation. |
| ThousandEyes Enterprise Agent Physical Appliance Agent; Virtual Appliance Agent | Auto-updated - no customer action required. |
| Ultra Cloud Core - Access and Mobility Management Function | 2026.04.0 (Nov 2026). |
| Ultra Cloud Core - Subscriber Microservices Infrastructure | 2026.04.1 (Nov 2026). |
| Ultra Packet Core - Network Repository Function; Session Management Function; User Plane Function | Nov 15, 2026. |
| Ultra Packet Core - Policy Control Function (PCF) | Nov 7, 2026. |
| Webex Calling | Cloud remediated. |
| Webex Meetings | Cloud remediation in progress - no customer action required. |
| MDS 9000 Series Multilayer Switches | Releases 9.4(1) through 9.4(5a) are affected; code train 9.3 is not affected. |
| Nexus 3000 Series Switches | Releases 9.3(9) through 9.3(18) are affected; code train 10.x is affected except train 10.1. |
| Nexus 9000 Series Fabric Switches in ACI mode | Code trains 15.x and 16.x are affected. |
| Nexus 9000 Series Switches in standalone NX-OS | Releases 9.3(9) through 9.3(18) are affected; the source record is truncated after code train 10.x. |
Mechanism and impact
The weakened private keys could be brute-forced in seconds, affecting trust in the associated certificates. Cisco’s stated response is to distrust eMudhra CAs or update software/certificates, depending on the product.
Remediation and mitigation
- Compare the products and branches in use with the Cisco advisory, then apply the relevant eMudhra CA distrust guidance.
- Upgrade to the release or apply the remediation Cisco lists for the product. Some target dates extend into 2027; follow the advisory for additions to the product scope and fixes.
- For Secure Email and Web Manager and Secure Email Gateway configured for manual updates, use
cli->updatenowto download Trusted Root 2.8. - For NSO Container, DNF can be used to upgrade
ca-certificatesto2026.2.92_v9.0.319-100.3.el10_2.
Cisco says no temporary workaround is currently available.