Microsoft has issued an out-of-band Windows update focused on certificate trust lists, rather than an emergency fix for newly introduced problems.
The non-security update is available for supported Windows versions, including Windows 11, Windows Server 2025, and Windows 10. It updates the current certificate trust list on devices that cannot reach Microsoft’s certificate-update service or have automatic certificate-list updates disabled.
The package also includes the contents of the October 13 update. That release came with known issues affecting VPN connections, on-premises Exchange Server, Smart App Control, audio, and Remote Desktop for non-administrator users. Microsoft has not fixed those problems in this new update, so administrators should take them into account before installing it.
Most devices receive certificate-list updates automatically and may not need this patch. But systems that cannot use the update service may benefit from it, since outdated trust information can cause problems when applications or websites verify certificates.
The release follows Microsoft’s response to the compromise of private keys belonging to Indian certificate authority eMudhra. Microsoft said the keys could potentially be used to create certificates or sign content that appeared to come from a trusted certificate authority.
To address the incident, Microsoft updated Windows’ Disallowed Certificate Trust List. The October 26 out-of-band update removes seven certificates from the Windows trust list: six eMudhra G3 root certificates and an AAA Certificate Services cross-sign. Microsoft also issued a separate CRLSet update for Edge and WebView2.