Loading vulnerability…
Trusted certificate forgery through weak eMudhra intermediate CA keys
CVE-2026-114406 affects certificate trust stores containing root CA certificates that validate eMudhra intermediate CA certificates with weak private keys. A man-in-the-middle attacker could exploit those weak keys to issue certificates for arbitrary hostnames that affected TLS/SSL clients accept as trusted. Affected products include Red Hat products using the system trust store distributed through ca-certificates RPM packages and XenServer 8.4 and 9 deployments using LDAPS. Because selective distrust of intermediate certificates is not supported consistently across clients, corrective updates remove the relevant root CA certificates.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits impersonation of legitimate TLS/SSL services, potentially exposing sensitive communications and allowing modification of exchanged data. In XenServer deployments using LDAPS, an attacker on the management network could impersonate a trusted directory server and potentially cause a XenServer host to authorize attacker access. The published CVSS assessment identifies high confidentiality and integrity impacts and no availability impact.
If you can’t patch tonight, do this now.
Remove trust in root CA certificates that validate the affected weak intermediate certificates. Blocking only the intermediate certificates is not a reliable system-wide mitigation because not all clients support selective intermediate distrust. XenServer has no specified interim workaround; deployments not using LDAPS are unaffected by the documented XenServer attack scenario.
Patch, then assume compromise.
Install the applicable vendor security updates. For RHEL 8, update ca-certificates to 2026.2.92_v9.0.319-81.3.el8_10 or a superseding fixed release under RHSA-2026:88550. For RHEL 9, use 2026.2.92_v9.0.319-90.3.el9_8 or a superseding fixed release under RHSA-2026:88459. For RHEL 10, use 2026.2.92_v9.0.319-100.3.el10_2 or a superseding fixed release under RHSA-2026:88455. These updates remove trust anchors associated with the weak intermediates. For XenServer 8.4 and 9, install the latest updates from the deployment's selected Early Access or Normal update channel; fixes are available in both channels.
No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.