Summary

Brocade Security has become aware of a critical certificate authority incident disclosed on October 17, 2026, related to eight eMudhra intermediate CA certificates. A flaw in the key generation process could allow attackers to recover private keys and issue fraudulent TLS or code-signing certificates. The affected intermediates have been revoked and blocked by major platform vendors. The issue with various CVEids.

More details:

• https://emudhra.com/en/post/certificate-security-incident
• https://access.redhat.com/security/vulnerabilities/RHSB-2026-012
• https://blog.qualys.com/product-tech/2026/10/23/how-to-identify-compromised-emudhra-certificates-with-qualys-cve-2026-111943-and-cve-2026-111944
• https://www.rapid7.com/db/vulnerabilities/cve-2026-91403/

Overview of CVEs & Affected Ecosystems

• CVE-2026-91403 (CVSS 3.1 Score: 9.1): Affects Oracle Java SE (8u511, 11.0.33, 17.0.21, 21.0.13, 25.0.5, 27.0.1) and Oracle GraalVM via JSSE (Java Secure Socket Extension), allowing potential Man-in-the-Middle (MitM) attacks. Oracle released an out-of-band emergency security patch.
• CVE-2026-111943: Tracks updates in the Go (Golang) standard library (crypto/x509), fixed in Go 1.27.3 and Go 1.26.10 to proactively block the compromised intermediate chains.
• CVE-2026-111944: More details in Qualys advisory
• CVE-2026-114406: Tracks system trust store updates for Red Hat Enterprise Linux (RHEL) (ca-certificates packages across RHEL 8, 9, and 10 via RHSB-2026-012 / RHSA updates).
• CVE-2026-113812: Assigned for Perl (Mozilla::CA) trust store management.
• Firefox OneCRL / Mozilla (CVE-2026-113470): Mozilla updated NSS and Firefox (158.0.1, ESR 153.5.1, ESR 115.43.1) to block the affected certificates.

Products Confirmed Not Affected

Brocade Fibre Channel products do not ship with pre-installed  public Certificate Authority (CA) root stores or bundles by default.

Revision History

Disclaimer

THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS SOLELY FOR INFORMATIONAL PURPOSES AND DOES NOT IMPLY ANY KIND OF GUARANTY OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. YOUR USE OF THE INFORMATION CONTAINED HEREIN IS AT YOUR OWN RISK. ALL INFORMATION PROVIDED HEREIN IS BASED ON BROCADE'S CURRENT KNOWLEDGE AND UNDERSTANDING OF THE VULNERABILITY AND IMPACT TO BROCADE HARDWARE AND SOFTWARE PRODUCTS. BROCADE RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.