CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles
Source AWS Security Bulletins
Not known to be exploited.
Data as of 10/25/2026, 05:51:09 UTC
CVSS not yet scored by NVD
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 3% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
AWS is removing the affected root certificates from their trust bundles to mitigate the risk. Customers should verify whether their certificates chain to any of the affected roots (AAA Certificate Services, emSign Root TLS CA - G3, emSign ECC Root CA - G3) and reissue certificates from a different, unaffected CA before AWS enforces the removal. Monitoring AWS Security Bulletins for updates is recommended to ensure timely remediation.
Description
CVE-2026-111943 is a key-generation flaw in the external certificate authority eMudhra/emSign that made intermediate CA private keys recoverable. Three root certificates—AAA Certificate Services, emSign Root TLS CA - G3, and emSign ECC Root CA - G3—were included in AWS trust bundles. This exposure allows soft-fail TLS clients to be vulnerable to man-in-the-middle attacks. AWS is actively removing these affected roots from their trust bundles. Customers using CloudFront custom origins or Application Load Balancer OIDC/JWT authentication should verify if their certificates chain to any of the affected roots and reissue certificates from a different CA before enforcement occurs.
Impact
The vulnerability exposes intermediate CA private keys, which compromises the trustworthiness of certificates issued under these roots. This can lead to man-in-the-middle attacks against TLS clients that rely on the affected AWS trust bundles, particularly those using CloudFront custom origins or ALB OIDC/JWT authentication. The exposure undermines the security of TLS connections, potentially allowing attackers to intercept or manipulate encrypted communications.