Resolved on October 20, 2026.
On October 22, 2026, additional intermediate CAs were identified that were signed, but never logged to Certificate Transparency (CT). iboss has confirmed that the existing patch applied to all Cloud Gateways and 10.4.1.249 is already sufficient to distrust these additional intermediate CA's.
Update timeline
- investigating Oct 20, 2026, 10:17 PM UTC
On October 20, 2026, it was publicly disclosed that the private keys of eight eMudhra intermediate CA certificates were compromised. iboss is proactively updating the trust store on all Cloud-Connected Gateways and no customer action is required. Customers with Gateways that are not Cloud-Connected should update to version 10.4.1.249, available from the on-premises update store, to receive the same protection. Note: During this process, you may see that version 10.5.0.0 is available. No action is needed on your part, and core functionality outside the scope of this advisory is not changing. No impacts to user traffic are expected. For full details, affected certificates, and recommended actions, see the full advisory: https://docs.iboss.com/platform-documentation-public/zrXebEPDRlGNwiYPcCcz/notices-and-advisories/advisories/2026-advisories/emudhra-intermediate-ca-compromise-advisory
- monitoring Oct 22, 2026, 09:34 AM UTC
Trust store updates have been completed successfully.
- monitoring Oct 22, 2026, 07:57 PM UTC
On October 22, 2026, additional intermediate CAs were identified that were signed, but never logged to Certificate Transparency (CT). iboss has confirmed that the existing patch applied to all Cloud Gateways and 10.4.1.249 is already sufficient to distrust these additional intermediate CA's.
Your product runs on more than iboss
Add the vendors you depend on and get one message when any of them reports trouble. Free for 3 vendors, no card.
Amazon Web Services