Compromised eMudhra Intermediate Certificate Authorities on Splunk Products - October 2026

Description

Between October 17 and October 20, 2026, a critical security compromise involving Certificate Authorities that are managed by eMudhra was uncovered.

A security researcher demonstrated that the private keys for eight eMudhra intermediate certificates were fundamentally broken due to an unprecedented error in their Key Generation Ceremony (KGC) in April 2025. This allows anyone to brute-force acquire these private keys within seconds. For more information, see eMudhra Intermediate CA Compromise and the Cisco Talos blog post Compromised eMudhra intermediate certificates.

Splunk’s analysis found that no Splunk products or services use eMudhra certificates. The reported compromise of eMudhra certificate authority private keys did not compromise Splunk’s own service certificates or code-signing certificates, and we have found no resulting compromise of Splunk products or services.

Splunk is investigating whether its products include an eMudhra CA certificate in a trust store and, if so, whether that could affect product behavior. The certificate’s presence alone or using a particular third-party package at runtime does not establish that a Splunk product is affected. Impact depends on whether an active network path loads the affected trust store and uses it to validate a remote certificate chain. Splunk is reviewing both package contents and whether active code paths can reach and use the certificate.

Product Status